oracle fusion supply chain management implementing innovation … · 2014-06-26 · overview 1-1 1...

Oracle Fusion Supply Chain Management Implementing Innovation Management

11g Release 8 (11.1.8

April 2014

Oracle® Fusion Supply Chain Management Implementing Innovation Management

Part Number E48180-03

Copyright © 2011-2014, Oracle and/or its affiliates. All rights reserved.

Author: Sabita Rao

This software and related documentation are provided under a license agreement containing restrictions on use anddisclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement orallowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform,publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of thissoftware, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find anyerrors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of theU.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programsinstalled on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computersoftware" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such,use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integratedsoftware, any programs installed on the hardware, and/or documentation, shall be subject to license terms and licenserestrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is notdeveloped or intended for use in any inherently dangerous applications, including applications that may create a risk ofpersonal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take allappropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliatesdisclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle Corporation and/or its affiliates. Other names may be trademarks oftheir respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used underlicense and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and theAMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark ofThe Open Group.

This software or hardware and documentation may provide access to or information on content, products and services fromthird parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kindwith respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible forany loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc

Oracle customers have access to electronic support through My Oracle Support. For information, visit or visit if you arehearing impaired.

http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc

http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc

Contents

1 Overview

Oracle Fusion Innovation Management: Overview .......................................................... 1-1

Implementing Innovation Management: Explained ..........................................................1-2

Getting Started with an Implementation: Overview .........................................................1-4

Manage Application Implementation ............................................................................... 1-6

2 Define Initial Users

Define Synchronization of Users and Roles from LDAP ...................................................2-1

Define Implementation Users ........................................................................................... 2-1

Define Users ..................................................................................................................... 2-7

3 Define Security

Security Tasks: Highlights ................................................................................................ 3-1

Defining Security After Enterprise Setup: Points to Consider .......................................... 3-4

Security Tasks and Oracle Fusion Applications: How They Fit Together .......................... 3-7

Security Tasks: Overview ................................................................................................3-10

Define Data Security .......................................................................................................3-14

Define Automated Governance, Risk, and Performance Controls .................................. 3-33

4 Define Currencies and Currency Rates

Manage Currencies ........................................................................................................... 4-1

Manage Conversion Rate Types ....................................................................................... 4-3

Manage Daily Rates ..........................................................................................................4-7

5 Define Approval Management

Approval Management: Highlights .................................................................................. 5-1

6 Define Help Configuration

Define Help Configuration: Overview ..............................................................................6-1

Set Help Options .............................................................................................................. 6-1

FAQs for Assign Help Text Administration Duty .............................................................6-4

Manage Help Security Groups ......................................................................................... 6-4

Help File Customization ...................................................................................................6-5

Embedded Help Customization ......................................................................................6-16

7 Define Application Toolkit Configuration

Define Application Toolkit Configuration: Overview .......................................................7-1

Map Reports to Work Areas ............................................................................................. 7-1

Set Watchlist Options ........................................................................................................7-3

8 Maintain Common Reference Objects

Maintain Common Reference Objects: Overview ............................................................. 8-1

Define Application Taxonomy .......................................................................................... 8-1

Define Reference Data Sharing ......................................................................................... 8-4

Define ISO Reference Data ............................................................................................... 8-8

Manage Data Security Policies ........................................................................................8-12

Set Activity Stream Options ........................................................................................... 8-22

Manage Menu Customizations ....................................................................................... 8-22

Manage Audit Policies ....................................................................................................8-23

Manage Oracle Social Network Objects ..........................................................................8-25

Manage Applications Core Common Reference Objects .................................................8-31

9 Define WebLogic Communication Services Configuration

Click-to-Dial: Explained ....................................................................................................9-1

Click-to-Dial: Top Tasks .................................................................................................... 9-4

Configuring PSTN Gateway Address Using Topology Manager: Worked Example ..........9-5

10 Define Applications Core Configuration

Define Lookups ...............................................................................................................10-1

Manage Messages ........................................................................................................... 10-8

Define Document Sequences .........................................................................................10-10

Define Trees .................................................................................................................. 10-13

Define Profile Options .................................................................................................. 10-29

Define Flexfields ........................................................................................................... 10-38

Define Attachments ...................................................................................................... 10-76

11 Define Transactional Business Intelligence Configuration for Product Management

Define Transactional Business Intelligence Configuration .............................................. 11-1

12 Other Common Setup and Maintenance Tasks

Customization and Sandboxes ........................................................................................12-1

13 Importing and Exporting Setup Data

Configuration Packages: Explained ................................................................................ 13-1

Exporting and Importing Setup Data: Explained ............................................................13-1

Moving Common Reference Objects ...............................................................................13-2

14 Define Product Innovation

Class Management in Product Innovation: Explained .................................................... 14-1

Managing Lookups in Innovation Management: Explained ........................................... 14-2

Define Product Lifecycle Portfolio Management ............................................................ 14-2

Registering Agile PLM: Explained ..................................................................................14-3

Managing Target System: Explained ...............................................................................14-3

Preface

This Preface introduces the guides, online help, and other information sourcesavailable to help you more effectively use Oracle Fusion Applications.

Oracle Fusion Applications Help

You can access Oracle Fusion Applications Help for the current page, section,activity, or task by clicking the help icon. The following figure depicts the helpicon.

Note

If you don't see any help icons on your page, then click the Show Help iconbutton in the global area. However, not all pages have help icons.

You can add custom help files to replace or supplement the provided content.Each release update includes new help content to ensure you have access to thelatest information. Patching does not affect your custom help content.

Oracle Fusion Applications Guides

Oracle Fusion Applications guides are a structured collection of the help topics,examples, and FAQs from the help system packaged for easy download andoffline reference, and sequenced to facilitate learning. To access the guides, go toany page in Oracle Fusion Applications Help and select Documentation Libraryfrom the Navigator menu.

Guides are designed for specific audiences:

• User Guides address the tasks in one or more business processes. Theyare intended for users who perform these tasks, and managers lookingfor an overview of the business processes. They are organized by thebusiness process activities and tasks.

• Implementation Guides address the tasks required to set up an offering,or selected features of an offering. They are intended for implementors.They are organized to follow the task list sequence of the offerings, asdisplayed within the Setup and Maintenance work area provided byOracle Fusion Functional Setup Manager.

• Concept Guides explain the key concepts and decisions for a specificarea of functionality. They are intended for decision makers, such as chief

financial officers, financial analysts, and implementation consultants.They are organized by the logical flow of features and functions.

• Security Reference Manuals describe the predefined data that isincluded in the security reference implementation for one offering. Theyare intended for implementors, security administrators, and auditors.They are organized by role.

These guides cover specific business processes and offerings. Common areas areaddressed in the guides listed in the following table.

Guide Intended Audience Purpose

Common User Guide All users Explains tasks performed by mostusers.

Common Implementation Guide Implementors Explains tasks within theDefine Common ApplicationsConfiguration task list, which isincluded in all offerings.

Functional Setup Manager UserGuide

Implementors Explains how to use OracleFusion Functional Setup Managerto plan, manage, and trackyour implementation projects,migrate setup data, and validateimplementations.

Technical Guides System administrators,application developers,and technical members ofimplementation teams

Explain how to install, patch,administer, and customize OracleFusion Applications.

NoteLimited content applicable toOracle Cloud implementations.

For other guides, go to Oracle Technology Network at http://www.oracle.com/technetwork/indexes/documentation.

Other Information Sources

My Oracle Support

Oracle customers have access to electronic support through My OracleSupport. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

Use the My Oracle Support Knowledge Browser to find documents for a productarea. You can search for release-specific information, such as patches, alerts,white papers, and troubleshooting tips. Other services include health checks,guided lifecycle advice, and direct contact with industry experts through the MyOracle Support Community.

http://www.oracle.com/technetwork/indexes/documentation

http://www.oracle.com/technetwork/indexes/documentation

http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info

http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info

http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs

http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs

Oracle Enterprise Repository for Oracle Fusion Applications

Oracle Enterprise Repository for Oracle Fusion Applications provides detailson service-oriented architecture assets to help you manage the lifecycle of yoursoftware from planning through implementation, testing, production, andchanges.

In Oracle Fusion Applications, you can use Oracle Enterprise Repository athttp://fusionappsoer.oracle.com for:

• Technical information about integrating with other applications,including services, operations, composites, events, and integration tables.The classification scheme shows the scenarios in which you use theassets, and includes diagrams, schematics, and links to other technicaldocumentation.

• Other technical information such as reusable components, policies,architecture diagrams, and topology diagrams.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the OracleAccessibility Program website at http://www.oracle.com/us/corporate/accessibility/index.html.

Comments and Suggestions

Your comments are important to us. We encourage you to send us feedbackabout Oracle Fusion Applications Help and guides. Please send yoursuggestions to [email protected]. You canuse Send Feedback to Oracle from the Settings and Actions menu in OracleFusion Applications Help.

http://fusionappsoer.oracle.com

Overview 1-1

1Overview

Oracle Fusion Innovation Management: Overview

Oracle Fusion Innovation Management is a solution set in the ProductManagement offering that aims to provide closed loop integration betweenstrategic planning and innovation execution.Oracle Fusion Innovation Management consists of the following three products,available independently under the Product Management offering, along withProduct Information Management:

• Product Requirements and Ideation Management• Concept Design Management• Product Lifecycle Portfolio Management

Product Description

Product Requirements and Ideation Management Allows employees and stakeholders to collaborateon product innovation ideas, record requirements,and develop feature sets.

Product managers can integrate requirements withconcepts in Concept Design Management, andideas with proposals in Product Lifecycle PortfolioManagement.

Concept Design Management Offers a collaborative design workspace for productarchitects, designers and executives to generate,capture, analyze, and approve product concepts thataddress product strategy goals.

Approved concepts can then be transferred directlyto Product Lifecylce Management (PLM) solutionsfor prototype planning, detailed design and productintroduction.

Product Lifecycle Portfolio Management Allows product portfolio managers to create,analyze, manage and revise product portfolios, toarrive at an optimal product mix.

Portfolio managers can also optimize resourcesacross a portfolio, evaluate portfolios, and designroadmaps.

For information on implementing Product Information Management, see theOracle Fusion Applications Product Information Management ImplementationGuide.

1-2 Oracle Fusion Supply Chain Management Implementing Innovation Management

Implementing Innovation Management: Explained

This topic provides an overview of the setup task lists and tasks that are specificto setting up Innovation Management, and the required common applicationsetup tasks for all Oracle Fusion Applications.

Before you begin, use the Getting Started page in the Setup and Maintenancework area to access the complete list of setup tasks, descriptions of the optionsand features that you can select when you configure the offering, and lists ofassociated business objects and enterprise applications.

The first implementation step is to configure the offerings in the Setup andMaintenance work area by selecting the offerings and options that you want tomake available to implement. For Innovation Management, you can select thefollowing options under the Product Management offering:

• Product Requirements and Ideation Management

• Concept Design Management

• Product Lifecycle Portfolio Management

Next, create one or more implementation projects for the offerings and optionsthat you want to implement. This generates task lists for each project. Theapplication implementation manager can customize the task list and assign andtrack each task.

If you select all of the options, then the generated task list for this offeringcontains the following groups of tasks:

Overview 1-3

Task List Description

Define Common Applications Configuration forProduct Management

• Define Initial Users for Product Management

• Define Synchronization of Users andRoles from LDAP

• Define Implementation Users forProduct Management

• Define Users and Security for ProductManagement

• Define Users for Supply ChainManagement

• Manage Job Roles

• Manage Duties

• Define Data Security for ProductManagement

• Define Automated Governance, Risk,and Performance Controls for ProductManagement

• Define Extensions for Product Management

• Define Help Configuration for ProductManagement

• Define Application ToolkitConfiguration

• Maintain Common Reference Objects

• Define Weblogic CommunicationServices Configuration for ProductManagement

• Define Approval Management forProduct Management

• Define Applications Core Configuration

Use this task list to manage definitions used acrossofferings, typically applying to multiple productsand product families. These definitions includesecurity and approval rules, amongst others.

You can find other information that supports thecommon implementation tasks in the Oracle FusionApplications Concepts Guide.

Define Transactional Business IntelligenceConfiguration

Use this task list to configure Oracle TransactionalBusiness Intelligence and enable businessintelligence reporting with Oracle FusionApplications.

Other Common Setup and Maintenance Tasks Use this task list to configure specific extensions forcustomizing Product Management.

For more information, see the Oracle FusionApplications Extensibility Guide.


Define Product Innovation

• Define Product Requirements and IdeationManagement

• Manage Product Idea Classes

• Manage Product Idea Statuses

• Manage Product Requirements Classes

• Manage Product Requirements Statuses

• Manage Product Requirements andIdeation Lookups

• Define Concept Design Management

• Manage Product Concept Classes

• Manage Product Concept ComponentClasses

• Manage Product Concept Statuses

• Manage Product Concept Lookups

• Define Product Lifecycle PortfolioManagement

• Manage Proposal Statuses

• Manage Product Portfolio Classes

• Manage Portfolio Statuses

• Manage Product Portfolio PlanningPeriods

• Manage Product Portfolio Metrics

• Manage Product Portfolio Lookups

• Manage Portfolio and Product Rule Sets

• Register Agile PLM

• Manage Target Systems

Use this task list to configure ideas, requirementsspecifications, feature sets, concepts, proposals, andportfolios.

Getting Started with an Implementation: Overview

To start an Oracle Fusion Applications implementation, you must set up one ormore initial users using the super user that was created during installation andprovisioning of the Oracle Fusion Applications environment, or using the initialadministrator user provided by Oracle for Oracle Cloud Application Servicesimplementations. Because Oracle Fusion Applications is secure as delivered, theprocess of enabling the necessary setup access for initial users requires severalspecialized steps when getting started with an implementation.

The following high level steps are required for starting an implementation.

Overview 1-5

1. If you are not starting an Oracle Cloud Application Servicesimplementation, sign into Oracle Identity Manager (OIM) as the OIMAdministration users and provision the IT Security Manager job role withroles for user and role management. This enables the super user account,which is provisioned with the IT Security Manager job role, to createimplementation users.

2. For starting all implementations, sign in as the user with initial access:either the Oracle Fusion Applications installation super user or the initialOracle Cloud Application Services administrator user.

3. Select an offering to implement, and generate the setup tasks needed toimplement the offering.

4. Perform the following security tasks:

a. Synchronize users and roles in the Lightweight Directory AccessProtocol (LDAP) store with HCM user management by using the RunUser and Roles Synchronization Process task.

b. Create an IT security manager user by using the Create ImplementationUsers task.

c. Provision the IT security manager with the IT Security Manager role byusing the Provision Roles to Implementation Users task.

5. As the newly created IT security manager user, sign in to Oracle FusionApplications and set up at least one implementation user for setting upenterprise structures.

a. Create an implementation user by using the Create ImplementationUsers task.

b. Provision the implementation user with the ApplicationImplementation Manager job role or the Application ImplementationConsultant job role by using the Provision Roles to ImplementationUsers task. The Application Implementation Consultant job roleinherits from all product-specific application administrators andentitles the necessary View All access to all secured objects.

c. Optionally, create a data role for an implementation user who needsonly the limited access of a product-specific Application Administratorby using the Create Data Role for Implementation Users. Then assignthe resulting data role to the implementation user by using theProvision Roles to Implementation Users task.

The figure shows the task flow from provisioning the IT Security Manager jobrole with the user and role management entitlement to creating and provisioningimplementation users for enterprise setup.


Manage Application Implementation

Manage Application Implementation: Overview

The Manage Applications Implementation business process enables rapid andefficient planning, configuration, implementation, deployment, and ongoingmaintenance of Oracle Fusion applications through self-service administration.

The Setup and Maintenance work area offers you the following benefits:

• Prepackaged Lists of Implementation Tasks

Task lists can be easily configured and extended to better fit with businessrequirements. Auto-generated, sequential task lists include prerequisitesand address dependencies to give full visibility to end-to-end setuprequirements of Oracle Fusion applications.

• Rapid Start

Specific implementations can become templates to facilitate reuse andrapid-start for comparable Oracle Fusion applications across manyinstances.

Overview 1-7

• Comprehensive Reporting

A set of built-in reports helps to analyze, validate and auditconfigurations, implementations, and setup data of Oracle Fusionapplications.

With Oracle Fusion Functional Setup Manager you can:

• Learn about and analyze implementation requirements.

• Configure Oracle Fusion applications to match your business needs.

• Achieve complete visibility to setup requirements through guided,sequential task lists downloadable into Excel for project planning.

• Enter setup data through easy-to-use user interfaces available directlyfrom the task lists.

• Export and import data from one instance to another for rapid setup.

• Validate setup by reviewing setup data reports.

• Implement all Oracle Fusion applications through a standard andconsistent process.

The following documentation resources are available for learning how toconfigure Oracle Fusion Applications.

• Functional Setup Manager Developer's Guide

• Common Implementation Guide

• Customer Data Management Implementation Guide

• Enterprise Contracts Implementation Guide

• Marketing Implementation Guide

• Sales Implementation Guide

• Fusion Accounting Hub Implementation Guide

• Financials Implementation Guide

• Compensation Management Implementation Guide

• Workforce Deployment Implementation Guide

• Workforce Development Implementation Guide

• Incentive Compensation Implementation Guide

• Procurement Implementation Guide

• P6 EPPM Administrator's Guide for an Oracle Database

• P6 EPPM Administrator's Guide for Microsoft SQL Server Database


Implementation Projects: Explained

An implementation project is the list of setup tasks you need to complete toimplement selected offerings and functional areas. You create a project byselecting the offerings and functional areas you want to implement together. Youmanage the project as a unit throughout the implementation lifecycle. You canassign these tasks to users and track their completion using the included projectmanagement tools.

Maintaining Setup Data

You can also create an implementation project to maintain the setup of specificbusiness processes and activities. In this case, you select specific setup task listsand tasks

Exporting and Importing

Implementation projects are also the foundation for setup export and import.You use them to identify which business objects, and consequently setup data,you will export or import and in which order.

Selecting Offerings

When creating an implementation project you see the list of offerings andfunctional areas that are configured for implementation. Implementationmanagers specify which of those offerings and functional areas to include in animplementation project. There are no hard and fast rules for how many offeringsyou should include in one implementation project. The implementation managershould decide based on how they plan to manage their implementations. Forexample, if you will implement and deploy different offerings at different times,then having separate implementation projects will make it easier to manage theimplementation life cycles. Furthermore, the more offerings you included in animplementation project, the bigger the generated task list will be. This is becausethe implementation task list includes all setup tasks needed to implement allincluded offerings. Alternatively, segmenting into multiple implementationprojects makes the process easier to manage.

Offerings: Explained

Offerings are application solution sets representing one or more businessprocesses and activities that you typically provision and implement as a unit.They are, therefore, the primary drivers of functional setup of Oracle Fusionapplications. Some of the examples of offerings are Financials, Procurement,Sales, Marketing, Order Orchestration, and Workforce Deployment. An offeringmay have one or more functional area, and one or more or features.

Implementation Task Lists

The configuration of the offerings will determine how the list of setup tasks isgenerated during the implementation phase. Only the setup tasks needed to

Overview 1-9

implement the selected offerings, functional areas and features will be includedin the task list, giving you a targeted, clutter-free task list necessary to meet yourimplementation requirements.

Enabling Offerings

Offerings and their functional areas are presented in an expandable andcollapsible hierarchy to facilitate progressive decision making when specifyingwhether or not an enterprise plans to implement them. An offering or itsfunctional areas can either be selected or not be selected for implementation.Implementation managers decide which offerings to enable.

Provisioning Offerings

The Provisioned column on the Configure Offerings page shows whether ornot an offering is provisioned. While you are not prevented from configuringofferings that have not been provisioned, ultimately the users are not able toperform the tasks needed to enter setup data for those offerings until appropriateenterprise applications (Java EE applications) are provisioned and their location(end point URLs) is registered.

Options: Explained

Each offering in general includes a set of standard functionality and a set ofoptional modules, which are called options. For example, in addition to standardOpportunity Management, the Sales offering includes optional functionalitysuch as Sales Catalog, Sales Forecasting, Sales Prediction Engine, and OutlookIntegration. These optional functions may not be relevant to all applicationimplementations. Because these are subprocesses within an offering, you do notalways implement options that are not core to the standard transactions of theoffering.

Feature Choices: Explained

Offerings include optional or alternative business rules or processes calledfeature choices. You make feature selections according to your businessrequirements to get the best fit with the offering. If the selected offeringsand options have dependent features then those features are applicablewhen you implement the corresponding offering or option. In general, thefeatures are set with a default configuration based on their typical usage inmost implementations. However, you should always review the availablefeature choices for their selected offerings and options and configure them asappropriate for the implementation.

You can configure feature choices in three different ways:

Yes or No

If a feature can either be applicable or not be applicable to an implementation, asingle checkbox is presented for selection. Check or uncheck to specify yes or norespectively.


Single Select

If a feature has multiple choices but only one can be applicable to animplementation, multiple choices are presented as radio buttons. You can turnon only one of those choices.

Multi-Select

If the feature has multiple choices but one or more can be applicable to animplementation then all choices are presented with a checkbox. Select all thatapply by checking the appropriate choices.

Define Initial Users 2-1

2Define Initial Users

Define Synchronization of Users and Roles from LDAP

User and Role Synchronization: Explained

Oracle Identity Management (OIM) maintains Lightweight Directory AccessProtocol (LDAP) user accounts for users of Oracle Fusion applications. OIM alsostores the definitions of abstract, job, and data roles and holds information aboutroles provisioned to users. During implementation, any existing informationabout users, roles, and roles provisioned to users must be copied from theLDAP directory to the Oracle Fusion Applications tables. Once the OracleFusion Applications tables are initialized with this information, it is maintainedautomatically. To perform the initialization, you run the process Retrieve LatestLDAP Changes.

Note

For security and audit best practice, implementation users have person recordsand appropriate role-based security access. So that appropriate roles can beassigned to implementation users, you must run the process Retrieve LatestLDAP Changes before you create implementation users.

During initial implementation, the installation super user performs the task RunUser and Role Synchronization Process to run the Retrieve Latest LDAP Changesprocess.

Tip

The user name and password of the installation super user are created duringinstallation provisioning of Oracle Fusion Applications. For details of the username and password, contact your system administrator or the person whoinstalled Oracle Fusion Applications.

Define Implementation Users

Initial Security Administration: Critical Choices

After installation and provisioning, and before setting up enterprise structuresand implementing projects, you must establish required entitlement for the


super user account and at least one implementation user to proceed withthe implementation. Once initial enterprise structure setup is complete,additional users may be created through processes available in Human CapitalManagement (HCM).

Initial security administration consists of the following.

• Preparing the IT Security Manager job role

• Synchronizing users and roles from Lightweight Directory AccessProtocol (LDAP) with HCM

• Creating implementation users

• Optionally creating data roles for implementation users

• Provisioning implementation users with roles

Once the first implementation project begins and the enterprise work structureis set up, use standard user and security management processes such as theManage Users task to create and manage additional users. Do not use the CreateImplementation Users task after your enterprise has been set up.

Preparing the IT Security Manager Job Role

Initially the super user is not provisioned to manage users and roles.

You must add the following Oracle Identity Management (OIM) roles to the ITSecurity Manager job role's role hierarchy to enable the super user to create oneor more initial implementation users.

• Identity User Administrators

• Role Administrators

Additionally, you must assign the Xellerate Users organization to the IT SecurityManager role.

Synchronizing Users and Roles from LDAP

After configuring an offering and setting up the task lists for implementation, theRun User and Roles Synchronization Process task is available to the super userfor synchronizing users and roles in the LDAP store with Oracle Fusion HumanCapital Management (HCM).

Defining Initial Implementation Users

The super user is provisioned with roles that provide broad access to OracleFusion Middleware and Oracle Fusion Applications administration, and isnot suitable as an implementation user in most enterprises. The super usershould define at least one implementation user, which consists of creating theuser account and provisioning it with at least the Application ImplementationConsultant and Application Implementation Manager job roles.

As a security guideline, define an IT security manager user who in turn definesone or more implementation users to set up enterprise structures. The IT securitymanager users can provision the implementation user with the ApplicationImplementation Consultant role, which entitles access to all enterprise structures.


Or the IT security manager can create a data role that restricts access toenterprise structures of a specific product and provisioning that role.

Depending on the size of your implementation team, you may only need asingle implementation user for security administration, implementation projectmanagement, enterprise structures setup, and application implementation. Thatsingle user must then be provisioned with all indicated roles, and thereforebroad access.

Creating Implementation Users

The super user creates one or more implementation users by performing theCreate Implementation Users task.

Note

This initial implementation user is a user account created in Oracle IdentityManagement only, specifically for setting up enterprise structures, and is notrelated to a real person or identity such as a user defined in HCM.

Creating Data Roles for Implementation Users

As an alternative to provisioning an implementation user with the ApplicationImplementation Consultant role to access all enterprise structures, you may needimplementation users with access restricted to enterprise structures for specificproducts. In this case, use the Create Data Roles for Implementation Users taskto create a data role based on a job role with less broad access, such as the HCMApplication Administrator job role.

Provisioning Roles to Implementation Users

After creating an implementation user, you must provision the user with one ormore roles by performing the Provision Roles to Implementation Users task.

For example, assign a role to the implementation user that provides the accessnecessary for setting up the enterprise. Depending on need, provision to theimplementation user the predefined Applications Implementation Consultantrole or a product family-specific administrator data role, such as a data rolebased on the predefined Financials Applications Administrator.

Caution

The Application Implementation Consultant has broad access. It is a very usefulrole for experimentation or setting up a pilot environment, but may not besuitable for implementation users in a full implementation project.

Initial Security Administration: Worked Example

This example illustrates initial security administration after having installed andprovisioned an Oracle Fusion Applications environment.

In Oracle Fusion Applications, you manage users and security through OracleFusion Human Capital Management (HCM) user management flows, which


are included in each of the offering task lists. However, the HCM task flowsrequire that enterprise structures have been set up, and yet to add users whocan set up enterprise structures you need to have set up HCM. Therefore, youneed to create one or more initial implementation users who are responsible forproviding the following.

• Users and their applications security management

• Implementation project management

• Initial enterprise structures management

The following table summarizes key decisions for this scenario.

Decision In this Example

How to sign in to Oracle Fusion Applications for thefirst time

Use the super user account that was createdwhen installing and provisioning Oracle FusionApplications (for example, FAADMIN).

How to ensure that the roles and users in theLightweight Directory Access Protocol (LDAP) storematch what is available for selection when definingimplementation users

Perform the Run User and Roles SynchronizationProcess task.

How to create a first implementation user Prepare the IT Security Manager job role for user androle management so the super user and any otheruser provisioned with the IT Security Manager jobrole can manage users and roles.

How to establish security administration users Define an IT security manager user provisioned withthe IT Security Manager job role.

How to establish an implementation user with accessto set up enterprise structures

Define an implementation user provisioned with theApplication Implementation Consultant job role.

You create an initial implementation user by performing the following tasks.

1. The Oracle Identity Management System Administrator user provisionsthe IT Security Manager job role with roles for user and role management.

2. The Oracle Fusion Applications super user synchronizes LDAP userswith HCM user management so that users can be provisioned with rolesthrough HCM.

3. The Oracle Fusion Applications super user performs the CreateImplementation Users task to create one or more IT security manager andadministrator users provisioned with security administrative entitlement.

4. The IT Security Manager user signs in to Oracle Fusion Applications andperforms the Create Implementation Users task to create implementationmanagers and users.

5. The IT Security Manager user provisions implementation users forenterprise structure setup.

Note

The following tasks assume that the super user has configured an offering andset up task lists. When not following a task flow within an activity, you can findtasks in Navigator > Tools > Setup and Maintenance > All Tasks . Search forthe task and click its Go to Task icon in the search results.


Preparing the IT Security Manager Role

The super user that was created when installing and provisioning OracleFusion Applications (for example, FAADMIN), or the initial administrator userprovided by Oracle for Oracle Cloud Application Services, has all necessaryaccess for implementing Oracle Fusion Applications and administering security.This access is provided by the following roles:

• Application Implementation Consultant

• IT Security Manager

Neither of these roles provides access needed for creating and managing OracleFusion Applications users. Therefore, you must add the following two OIM rolesto the IT Security Manager role:

• Identity User Administrators

• Role Administrators

The following procedure is prerequisite to an IT security manager oradministrator creating an initial one or more implementation users.

1. While signed into Oracle Identity Manager as the OIM SystemAdministrator user, click the Administration link in the upper right of theOracle Identity Manager.

This accesses the Welcome to Identity Manager Delegated Administrationmenu.

2. In the Roles list of tasks, click Advanced Search - Roles. Search for theIdentity Users Administrators role by entering the role name in DisplayName and clicking Search.

In the Search Results, click the role's Display Name.

3. On the Hierarchy tab, select Inherits From and click Add.

4. In the Add Parent Role to: IDENTITY USER ADMINISTRATORS window,select the role category: Common - Job Roles and add the IT SecurityManager.

Click the arrow icon to show the list of available roles. Select IT SecurityManager and move it to the Roles to Add list. Click Save.

5. Search for the Role Administrators role, and repeat steps 1 to 4 to add thatrole to the IT Security Manager role's role inheritance.

6. Assign the IT Security Manager role to the Xellerate Users organization.a. In the Welcome to Identity Manager Delegated Administration menu

(see step 1, above), in the Organizations list of tasks, click AdvancedSearch - Organizations.

b. Search for the Xellerate Users organization by entering Xellerate Usersin Display Name and clicking Search.

c. In the Search Results, click the organization's Display Name. TheXellerate Users page appears.

d. Click the Administrative Roles link in the row of links above theXellerate Users.


e. In Filter By Role Name of the Details window, enter the followingstring:

*IT_SECURITY_MANAGER*

Click Find.

f. Enable Read, Write, Delete, and Assign.

g. Click Assign.

h. Click Confirm.

Synchronizing Users and Roles from LDAP

Lightweight Directory Access Protocol (LDAP) must be synchronized with HCMuser management so that users can be provisioned with roles through HCM.

1. Sign in to Oracle Fusion Applications using the super user's user name(for example FAADMIN) and password.

If you do not know the super user name and password, check withyour system administrator or the person who installed Oracle FusionApplications. For more information about account creation in OracleFusion Applications provisioning, see the Oracle Fusion ApplicationsInstallation Guide.

2. Perform the Run User and Roles Synchronization Process task by clickingSubmit in the Process Details page.

The Retrieve Latest LDAP Changes process takes some time to completethe first time it is run.

3. Monitor completion of the Retrieve Latest LDAP Changes process fromNavigator > Tools > Scheduled Processes before continuing withcreating implementation users.

Defining an IT Security Manager User

The super user has broad access to Oracle Fusion Middleware and Oracle FusionApplications administration. Due to this broad access, your enterprise needsusers dedicated to managing users and applications security, such as an ITsecurity manager user.

1. While signed in as the Oracle Fusion Applications super user, access theCreate Implementation Users task and create an IT security manager.

The Oracle Identity Manager appears.

2. Click Create User.

For details, see the Creating Users section in the Oracle FusionMiddleware User's Guide for Oracle Identity Manager.

3. Provide the following attributes:

Attribute Value Example

Last name <any valid string> Smith


Organization Xellerate Users N/A

User type Non Worker N/A

User login <any valid string> IT_SECURITY_MANAGER

Login password <any valid string> SeKur1TyPa$$w0Rd

Note

In Oracle Fusion Applications, an implementation user is a user accountcreated in OIM only, specifically for implementation tasks, and is notrelated to a real person or identity such as a user defined in HCM.

4. Click Save.

5. On the Roles tab in the IT_SECURITY_MANAGER user creation taskflow, click Assign.

6. In the Add Role window, search for the IT Security Manager role and clickAdd.

Defining an Implementation User for Enterprise Structures Setup

1. Sign in to Oracle Fusion Applications using the IT security manager user'sname and password.

2. Create and provision an implementation user using the same task flow asfor creating the IT security manager user in the previous section, exceptprovision the following roles.

• Application Implementation Manager


Note

For an implementation to begin, at least one user must be provisionedwith the Application Implementation Manager role, and another or thesame user must be provisioned with the Application ImplementationConsultant role. The Application Implementation Consultant has broadaccess to set up all enterprise structures.

Define Users

Securing Identities and Users: Points To Consider

Identity covers all aspects of an entity's existence within the contexts in whichit is used. The identity of an enterprise user consists of HR attributes, roles,resources, and relationships.

HR attributes include identifying information about a user that is relatively staticand well understood, such as first and last name, title, and job function.


Roles are part of a user's identity and define the user's purpose andresponsibilities.

Within identity management, resources define what a user can and does do. Inan enterprise, this typically translates into what resources a user has access to,what privileges they have on that resource, and what they have been doing onthat resource. Resources can be application accounts or physical devices such aslaptops or access cards. The enterprise owns the resources, secures them, andmanages access to the resources by managing the user's identity and access.

Relationships establish the portion of user identities that involve organizationaltransactions such as approvals.

An Oracle Fusion Applications user and corresponding identity are usuallycreated in a single transaction, such as when a worker is created in HumanResources (HR). That transaction automatically triggers provisioning requests forthe user based on role provisioning rules.

User accounts for some identities that are not employees, such as partnercontacts, may be created in a later transaction using an identity that is alreadycreated in the identity store. Supplier contacts are created in the Supplier Model,not HR.

Stores

Various locations store identity and user data.

Identity data consists of the following.

• HR person records

• Oracle Fusion Trading Community Model party records

In Oracle Fusion Applications, identities and users correspond one to one, butnot all identities correspond to a user, and not all users are provisioned with anidentity. Some identities stored in HR and Trading Community Model may notbe provisioned to user accounts and therefore are not synchronized with OracleIdentity Management (OIM). For example, a contact for a prospective customeris an identity in Trading Community Model but may not be provisioned witha user account in OIM. Some users stored in the Lightweight Directory AccessProtocol (LDAP) store may not be provisioned with identities. For example,system user accounts used to run Web services to integrate third party serviceswith Oracle Fusion Applications are not associated with a person record inHR or Trading Community Model. Some identifying credentials such as name,department, e-mail address, manager, and location are stored with user data inthe LDAP store.

Importing Users

You can import users or user attributes in bulk from existing legacy identity anduser stores.

Your tasks may include the following.

• Create users in bulk

• Update specific attributes for all users, such as postal code

• Link users to HR or Trading Community Model persons


• Monitor progress of the import process

• Correct errors & re-import

• Export users in bulk

• Import and export users using a standard plain text data interchangeformat like Lightweight Data Interchange Format (LDIF)

You can reserve a specific user name not currently in use for use in the future,or release a reserved username from the reservation list and make it availablefor use. Between a user registration request and approved registration, OracleFusion Applications holds the requested user name on the reservation list, andreleases the name if an error occurs in the self-registration process or the requestis rejected. Self-registration processes check the reservation list for user nameavailability and suggest alternative names.

Provisioning Events

New identities, such as new hires, trigger user and role provisioning events. Inaddition to user creation tasks, other tasks, such as Promote Worker or TransferWorker, result in role provisioning and recalculation based on role provisioningrules.

When an identity's attributes change, you may need to provision the userwith different roles. Role assignments may be based on job codes, and apromotion triggers role provisioning changes. Even if the change in the identitiesattributes requires no role assignment change, such as with a name change, OIMsynchronizes the corresponding user information in the LDAP store.

Deactivating or terminating an identity triggers revocation of some roles toend all assignments, but may provision new roles needed for activities, such asa pay stub review. If the corresponding user for the identity was provisionedwith a buyer role, terminating the identity causes the user's buyer record inProcurement to be disabled, just as the record was created when the user wasfirst provisioned with the buyer role.

Notifications and Audits

Oracle Fusion Applications provides mechanisms for notifying and auditingrequests or changes affecting identities and users.

Oracle Fusion Applications notifies requestors, approvers, and beneficiarieswhen a user account or role is provisioned. For example, when an anonymoususer registers as a business-to-customer (B2C) user, the B2C user must be notifiedof the registration activation steps, user account, password and so on once theapprover (if applicable) has approved the request and the user is registered inthe system.

User ID and GUID attributes are available in Oracle Fusion Applications sessioninformation for retrieving authenticated user and identity data.

End user auditing data is stored in database WHO columns and used for thefollowing activities.

• Setting up sign-in audit


• Using the application monitor

• Notifying of unsuccessful sign ins

• Sign-in audit reports

You can conduct real time audits that instantiate a runtime session andimpersonate the target user (with the proxy feature) to test what a user hasaccess to under various conditions such as inside or outside firewall andauthentication level.

For information on configuring audit policies and the audit store, see the OracleFusion Applications Administrator's Guide.

Delegated Administration

You can designate local administrators as delegated administrators to manage asubset of users and roles.

Delegated administrators can be internal or external persons who areprovisioned with a role that authorizes them to handle provisioning events for asubset of users and roles.

For example, internal delegated administrators could be designated tomanage users and roles at the division or department level. External delegatedadministrators could be designated to manage users and roles in an externalorganization such as a primary supplier contact managing secondary userswithin that supplier organization.

You can also define delegated administration policies based on roles. Youauthorize users provisioned with specific roles named in the policy to request asubset of roles for themselves if needed, such as authorizing a subset of roles fora subset of people. For example, the policy permits a manager of an AccountsPayables department to approve a check run administrator role for one of theirsubordinates, but prohibits the delegated administrator from provisioning abudget approver role to the subordinate.

Credentials

You activate or change credentials on users by managing them in Oracle IdentityManagement (OIM)

Applications themselves must be credentialed to access one another.

Oracle Fusion Applications distinguishes between user identities and applicationidentities (APPID). Predefined application identities serve to authorize jobs andtransactions that require higher privileges than users.

For example, a payroll manager may submit a payroll run. The payrollapplication may need access to the employee's taxpayer ID to print the payslip.However, the payroll manager is not authorized to view taxpayer IDs in the userinterface as they are considered personally identifiable information (PII).

Calling applications use application identities (APPID) to enable the flow oftransaction control as it moves across trust boundaries. For example, a user inthe Distributed Order Orchestration product may release an order for shipping.The code that runs the Pick Notes is in a different policy store than the code


that releases the product for shipment. When the pick note printing programis invoked it is the Oracle Fusion Distributed Order Orchestration ApplicationDevelopment Framework (ADF) that is invoking the program and not the enduser.

Manage HCM Role Provisioning Rules

Role Provisioning and Deprovisioning: Explained

A user's access to data and functions depends on the user's roles: users haveone or more roles that enable them to perform the tasks required by their jobs orpositions. Roles must be provisioned to users; otherwise, users have no access todata or functions.

Role Provisioning Methods

Roles can be provisioned to users:

• Automatically

• Manually, using delegated administration:

• Users such as line managers and human resource specialists canprovision roles manually to other users.

• Users can request roles for themselves.

For both automatic and manual role provisioning, you create a role mapping toidentify when a user becomes eligible for a role.

Oracle Identity Management (OIM) can be configured to notify users when theirroles change; notifications are not issued by default.

Role Types

Data roles, abstract roles, and job roles can be provisioned to users. Rolesavailable for provisioning include predefined roles, HCM data roles, and rolescreated using OIM.

Automatic Role Provisioning

A role is provisioned to a user automatically when at least one of the user'sassignments satisfies the conditions specified in the relevant role-mappingdefinition. The provisioning occurs when the assignment is either createdor updated. For example, when a person is promoted to a managementposition, the line manager role is provisioned automatically to the person if anappropriate role mapping exists. Any change to a person's assignment causesthe person's automatically provisioned roles to be reviewed and updated asnecessary.

Role Deprovisioning

Automatically provisioned roles are deprovisioned automatically as soon asa user no longer satisfies the role-mapping conditions. For example, a line


manager role that is provisioned to a user automatically is deprovisionedautomatically when the user ceases to be a line manager.

Automatically provisioned roles can be deprovisioned manually at any time.

Manually provisioned roles are deprovisioned automatically only when all of theuser's work relationships are terminated; in all other circumstances, users retainmanually provisioned roles until they are deprovisioned manually.

Changes to Assignment Managers

When a person's line manager is changed, the roles of both new and previousline managers are updated as necessary. For example, if the person's new linemanager now satisfies the conditions in the role mapping for the line managerrole, and the role is one that is eligible for autoprovisioning, then that role isprovisioned automatically to the new line manager. Similarly, if the previous linemanager no longer satisfies the conditions for the line manager role, then thatrole is deprovisioned automatically.

Roles at Termination

When a work relationship is terminated, all automatically provisioned roles forwhich the user does not qualify in other work relationships are deprovisionedautomatically. Manually provisioned roles are deprovisioned automaticallyonly if the user has no other work relationships; otherwise, the user retains allmanually provisioned roles until they are deprovisioned manually.

Automatic deprovisioning can occur either as soon as the termination issubmitted or approved or on the day after the termination date. The user who isterminating the work relationship selects the appropriate deprovisioning date.

Role mappings can provision roles to users automatically at termination. Forexample, the locally defined roles Retiree and Beneficiary could be provisionedto users at termination based on assignment status and person type values.

If a termination is later reversed, roles that were deprovisioned automaticallyat termination are reinstated and post-termination roles are deprovisionedautomatically.

Date-Effective Changes to Assignments

Automatic role provisioning and deprovisioning are based on current data. For afuture-dated transaction, such as a future promotion, role changes are identifiedand role provisioning occurs on the day the changes take effect, not when thechange is entered. The process Send Pending LDAP Requests identifies future-dated transactions and manages role provisioning and deprovisioning at theappropriate time. Note that such role-provisioning changes are effective as of thesystem date; therefore, a delay of up to 24 hours may occur before users in othertime zones acquire the access for which they now qualify.

Role Mappings: Explained

User access to data and functions is determined by abstract, job, and data roles,which are provisioned to users either automatically or manually. To enable arole to be provisioned to users, you define a relationship, known as a mapping,between the role and a set of conditions, typically assignment attributes suchas department, job, and system person type. In a role mapping, you can select


any role stored in the Lightweight Directory Access Protocol (LDAP) directory,including Oracle Fusion Applications predefined roles, roles created in OracleIdentity Management (OIM), and HCM data roles.

The role mapping can support:

• Automatic provisioning of roles to users

• Manual provisioning of roles to users

• Role requests from users

• Immediate provisioning of roles

Automatic Provisioning of Roles to Users

A role is provisioned to a user automatically if:

• At least one of the user's assignments satisfies all conditions associatedwith the role in the role mapping.

• You select the Autoprovision option for the role in the role mapping.

For example, for the HCM data role Sales Manager Finance Department, youcould select the Autoprovision option and specify the following conditions.

Attribute Value

Department Finance Department

Job Sales Manager

Assignment Status Active

The HCM data role Sales Manager Finance Department is provisionedautomatically to users with at least one assignment that satisfies all of theseconditions.

Automatic role provisioning occurs as soon as the user is confirmed to satisfythe role-mapping conditions, which can be when the user's assignment is eithercreated or updated. The provisioning process also removes automaticallyprovisioned roles from users who no longer satisfy the role-mapping conditions.

Note

The automatic provisioning of roles to users is effectively a request to OIM toprovision the role. OIM may reject the request if it violates segregation-of-dutiesrules or fails a custom OIM approval process.

Manual Provisioning of Roles to Users

Users such as human resource (HR) specialists and line managers can provisionroles manually to other users; you create a role mapping to identify roles that canbe provisioned in this way.

Users can provision a role to other users if:

• At least one of the assignments of the user who is provisioning the role(for example, the line manager) satisfies all conditions associated with therole mapping.

• You select the Requestable option for the role in the role mapping.


For example, for the HCM data role Quality Assurance Team Leader, you couldselect the Requestable option and specify the following conditions.

Attribute Value

Manager with Reports Yes


Any user with at least one assignment that satisfies both of these conditions canprovision the role Quality Assurance Team Leader manually to other users, whoare typically direct and indirect reports.

If the user's assignment subsequently changes, there is no automatic effecton roles provisioned by this user to others; they retain manually provisionedroles until either all of their work relationships are terminated or the roles aremanually deprovisioned.

Role Requests from Users

Users can request roles when reviewing their own account information; youcreate a role mapping to identify roles that users can request for themselves.

Users can request a role if:

• At least one of their own assignments satisfies all conditions associatedwith the role mapping.

• You select the Self-requestable option for the role in the role mapping.

For example, for the Expenses Reporting role you could select the Self-requestable option and specify the following conditions.

Attribute Value

Department ABC Department

System Person Type Employee


Any user with at least one assignment that satisfies all of these conditions canrequest the role. The user acquires the role either immediately or, if approvalis required, once the request is approved. Self-requested roles are classified asmanually provisioned.

If the user's assignment subsequently changes, there is no automatic effect onself-requested roles. Users retain manually provisioned roles until either all oftheir work relationships are terminated or the roles are manually deprovisioned.

Immediate Provisioning of Roles

When you create a role mapping, you can apply autoprovisioning from the rolemapping itself.

In this case, all assignments and role mappings in the enterprise are reviewed.Roles are:

• Provisioned immediately to all users who do not currently have roles forwhich they are eligible


• Deprovisioned immediately from users who are no longer eligible forroles that they currently have

Immediate autoprovisioning from the role mapping enables bulk automaticprovisioning of roles to a group of users who are identified by the role-mappingconditions. For example, if you create a new department after a merger, youcan provision relevant roles to all users in the new department by applyingautoprovisioning immediately.

To provision roles immediately to a single user, the user's line manager or an HRspecialist can autoprovision roles from that user's account.

Role-Mapping Names

The names of role mappings must be unique in the enterprise. You arerecommended to devise a naming scheme that reveals the scope of each rolemapping. For example:

Name Description

Autoprovisioned Roles Sales Department Mapping includes all roles provisionedautomatically to anyone in the sales department

Benefits Specialist Autoprovisioned Mapping defines the conditions for autoprovisioningthe Benefits Specialist role

Line Manager Requestable Roles Mapping includes all roles that a line manager canprovision manually to direct and indirect reports

Role Mappings: Examples

Roles must be provisioned to users explicitly, either automatically or manually;no role is provisioned to a user by default. This topic provides some examples oftypical role mappings to support automatic and manual role provisioning.

Creating a Role Mapping for Employees

You want all employees in your enterprise to have the Employee roleautomatically when they are hired. In addition, employees must be able torequest the Expenses Reporting role when they need to claim expenses. Fewemployees will need this role, so you decide not to provision it automatically toall employees.

You create a role mapping called All Employees and enter the followingconditions.

Attribute Value



In the role mapping you include the:

• Employee role, and select the Autoprovision option

• Expenses Reporting role, and select the Self-requestable option


You could create a similar role mapping for contingent workers called AllContingent Workers, where you would set the system person type to contingentworker.

Note

If the Employee and Contingent Worker roles are provisioned automatically,pending workers acquire them when their periods of employment or placementsstart. If they need roles before then, you create a separate role mapping for thepending worker system person type.

Creating a Role Mapping for Line Managers

Any type of worker can be a line manager in the sales business unit. You create arole mapping called Line Manager Sales BU and enter the following conditions.

Attribute Value

Business Unit Sales


Manager with Reports Yes

You include the Line Manager role and select the Autoprovision option. Thisrole mapping ensures that the Line Manager role is provisioned automaticallyto any worker with at least one assignment that matches the role-mappingconditions.

In the same role mapping, you could include roles that line managers in thisbusiness unit can provision manually to other users by selecting the roles andmarking them as requestable. Similarly, if line managers can request roles forthemselves, you could include those in the same role mapping and mark them asself-requestable.

Creating a Role Mapping for Retirees

Retirees in your enterprise need a limited amount of system access to managetheir retirement accounts. You create a role mapping called All Retirees and enterthe following conditions.

Attribute Value

System Person Type Retiree

Assignment Status Inactive

You include the locally defined role Retiree in the role mapping and select theAutoprovision option. When at least one of a worker's assignments satisfiesthe role-mapping conditions, the Retiree role is provisioned to that workerautomatically.

Creating a Role Mapping for Sales Managers

Grade 6 sales managers in the sales department need the Sales Manager role.In addition, sales managers need to be able to provision the Sales Associaterole to other workers. You create a role mapping called Sales Managers SalesDepartment and enter the following conditions.


Attribute Value

Department Sales

Job Sales manager

Grade 6


In the role mapping, you include the:

• Sales Manager role, and select the Autoprovision option

• Sales Associate role, and select the Requestable option

Import Worker Users

Defining Security After Enterprise Setup: Points to Consider

After the implementation user has set up the enterprise, further securityadministration depends on the requirements of your enterprise.

The Define Security activity within the Information Technology (IT)Management business process includes the following tasks.

• Import Worker Users

• Import Partner Users


• Manage Duties

• Manage Application Access Controls

If no legacy users, user accounts, roles, and role memberships are available in theLightweight Directory Access Protocol (LDAP) store, and no legacy workers areavailable in Human Resources (HR), the implementation user sets up new usersand user accounts and provisions them with roles available in the Oracle FusionApplications reference implementation.

If no legacy identities (workers, suppliers, customers) exist to represent peoplein your enterprise, implementation users can create new identities in HumanCapital Management (HCM), Supplier Portal, and Customer RelationshipManagement (CRM) Self Service, respectively, and associate them with users.

Before Importing Users

Oracle Identity Management (OIM) handles importing users.

If legacy employees, contingent workers, and their assignments exist, the HCMApplication Administrator imports these definitions by performing the InitiateHCM Spreadsheet Load task. If user and role provisioning rules have beendefined, the Initiate HCM Spreadsheet Load process automatically creates userand role provisioning requests as the workers are created.


Once the enterprise is set up, performing the Initiate HCM Spreadsheet Loadtask populates the enterprise with HR workers in records linked by global userID (GUID) to corresponding user accounts in the LDAP store. If no user accountsexist in the LDAP store, the Initiate HCM Spreadsheet Load task results in newuser accounts being created. Worker email addresses as an alternate input forthe Initiate HCM Spreadsheet Load task triggers a search of the LDAP for userGUIDs, which may perform more slowly than entering user names.

In the security reference implementation, the HCM Application Administratorjob role hierarchy includes the HCM Batch Data Loading Duty role, whichis entitled to import worker identities. This entitlement provides the accessnecessary to perform the Initiate HCM Spreadsheet Load task in HCM.

Note

The Import Person and Organization task in the Define Trading CommunityImport activity imports the following resources, creates users, and links theresources to users for use in CRM.

• Internal employees

• Contingent workers

• External partner contacts

• Partner companies

• Legal entities

• Customers

• Consumers

If role provisioning rules have been defined, the Import Person and Organizationtask automatically provisions role requests as the users are created.

Import Users

If legacy users (identities) and user accounts exist outside the LDAP store thatis being used by the Oracle Fusion Applications installation, the IT securitymanager has the option to import these definitions to the LDAP store byperforming the Import Worker Users and Import Partner Users tasks.

If no legacy users or user accounts can be imported or exist in an LDAPrepository accessible to Oracle Identity Management (OIM), the IT securitymanager creates users manually in OIM or uses the Initiate HCM SpreadsheetLoad task to create users from imported HR workers.

Once users exist, their access to Oracle Fusion Applications is dependent onthe roles provisioned to them in OIM or Human Capital Management. Use theManage HCM Role Provisioning Rules task to define rules that determine whatroles are provisioned to users.

Importing user identities from other applications, including other OracleApplications product lines, is either a data migration or manual task. Migratingdata from other Oracle Applications includes user data. For more informationabout importing users, see the Oracle Fusion Middleware Developer's Guide forOracle Identity Manager.


In the security reference implementation, the IT Security Manager job rolehierarchy includes the HCM Batch Data Loading Duty and the Partner AccountAdministration Duty. These duty roles provide entitlement to import or createusers. The entitlement Load Batch Data provides the access necessary toperform the Import Worker Users task in OIM. The entitlement Import Partnerentitlement provides the access necessary to perform the Import Partner Userstask in OIM.

Manage Job Roles

Job and abstract roles are managed in OIM. This task includes creating andmodifying job and abstract roles, but not managing role hierarchies of duties forthe jobs.

Note

Manage Job Roles does not include provisioning job roles to users. Provisioningusers is done in OIM, HCM, CRM or Oracle Fusion Supplier Portal.

Roles control access to application functions and data. Various types of rolesidentify the functions performed by users.

The Oracle Fusion Applications security reference implementation providespredefined job and abstract roles. In some cases, the jobs defined in yourenterprise may differ from the predefined job roles in the security referenceimplementation. The predefined roles and role hierarchies in Oracle Fusionmay require changes or your enterprise may require you to create new roles.For example, you need a job role for a petty cash administrator, in addition toan accounts payable manager. The security reference implementation includesa predefined Accounts Payable Manager, and you can create a petty cashadministrator role to extend the reference implementation.

In the security reference implementation, the IT Security Manager job rolehierarchy includes the Enterprise Role Management Duty role, which is entitledto manage job and abstract roles (the entitlement is Manage Enterprise Role).This entitlement provides the access necessary to perform the Manage Job Rolestask in OIM.

Manage Duties

A person with a job role must be able to perform certain duties. In the OracleFusion Applications security reference implementation, enterprise roles inheritduties through a role hierarchy. Each duty corresponds to a duty role. Duty rolesspecify the duties performed within applications and define the function anddata access granted to the enterprise roles that inherit the duty roles.

Managing duties includes assigning duties to job and abstract roles in a rolehierarchy using Authorization Policy Manager (APM). If your enterprise needsusers to perform some actions in applications coexistent with Oracle Fusionapplications, you may wish to remove the duty roles that enable those actions.For details about which duty roles are specific to the products in an offering, seethe Oracle Fusion Applications Security Reference Manual for each offering.

OIM stores the role hierarchy and the spanning of roles across multiple pillars orlogical partitions of applications.


In cases where your enterprise needs to provide access to custom functions,it may be necessary to create or modify the duty roles of the referenceimplementation.

Tip

As a security guideline, use only the predefined duty roles, unless you haveadded new applications functions. The predefined duty roles fully representthe functions and data that must be accessed by application users and containall appropriate entitlement. The predefined duty roles are inherently withoutsegregation of duty violations of the constraints used by the Application AccessControls Governor.

In the security reference implementation, the IT Security Manager job rolehierarchy includes the Application Role Management Duty role, which isentitled to manage duty roles (the entitlement is Manage Application Role). Thisentitlement provides the access necessary to perform the Manage Duties task inAPM.

Note

Product family administrators are not entitled to create role hierarchies ormanage duty roles and must work with the IT security manager to make changessuch as localizing a duty role to change a role hierarchy. Setup for localizations isdocumented in HCM documentation.

Manage Application Access Controls

Prevent or limit the business activities that a single person may initiate orvalidate by managing segregation of duties policies in the Application AccessControls Governor (AACG) .

Note

In AACG, segregation of duties policies are called access controls or segregationof duties controls.

In the security reference implementation, the IT Security Manager job rolehierarchy includes the Segregation of Duties Policy Management Duty role,which is entitled to manage segregation of duties policies (the entitlement isManage Segregation of Duties Policy). This entitlement provides the accessnecessary to perform the Manage Application Access Controls task in AACG.

Importing Worker Users: Explained

You can import workers from legacy applications to Oracle Fusion Applicationsusing the Import Worker Users task. By enabling you to bulk-load existing data,this task is an efficient way of creating and enabling users of Oracle FusionApplications.

The Import Worker Users Process

Importing worker users is a two-stage process:


1. When you perform the Import Worker Users task, the Initiate SpreadsheetLoad page opens. On the Initiate Spreadsheet Load page, you generateand complete the Create Worker spreadsheet. You must map your datato the spreadsheet columns and provide all required attributes. Once thespreadsheet is complete, you click Upload in the spreadsheet to importthe data to the Load Batch Data stage tables.

2. As valid data rows are imported to the Load Batch Data stage tables, theLoad Batch Data process runs automatically. Load Batch Data is a genericutility for loading data to Oracle Fusion Human Capital Managementfrom external sources. This process loads data from the Load Batch Datastage tables to the Oracle Fusion application tables.

User-Account Creation

Oracle Fusion user accounts are created automatically for imported workersin Oracle Identity Management (OIM), unless automatic account creation isdisabled.

By default, user account names and passwords are sent automatically to userswhen their accounts are created. This default action may have been changed atenterprise level, as follows:

• User account names and passwords may be sent to an enterprise-wide e-mail rather than to users themselves.

• Automatic sending of user account names and passwords may bedisabled for the enterprise. In this case, you can notify users at anappropriate time.

Role Provisioning

Once user accounts exist, roles are provisioned to users automatically inaccordance with current role-provisioning rules. For example, current rulescould provision the employee abstract role to every worker. Role provisioningoccurs automatically unless it is disabled for the enterprise.

Importing Worker Users: Worked Example

This example shows how to import worker users from legacy applications toOracle Fusion Applications.

The following table summarizes key decisions for this task.

Decisions to Consider In This Example

What is my spreadsheet name?

You can define your own naming convention. In thisexample, the name is selected to make identifyingthe spreadsheet contents easy.

WorkersMMDDYYBatchnn.xlsx

For example, Workers042713Batch01.xlsx.

What is my batch name?

You can define your own batch name, which must beunique. In this example, the batch name is the sameas the spreadsheet name.

Workers042713Batchnn


Summary of the Tasks

Import worker users by:

1. Selecting the Import Worker Users task

2. Creating the spreadsheet

3. Entering worker data in the spreadsheet

4. Importing worker data and correcting import errors

5. Reviewing and correcting load errors

Prerequisites

Before you can complete this task, you must have:

1. Installed the desktop client Oracle ADF Desktop Integration Add-in forExcel

2. Enabled the Trust Center setting Trust access to the VBA project objectmodel in Microsoft Excel

Selecting the Import Worker Users Task

1. On the Overview page of the Setup and Maintenance work area, click theAll Tasks tab.

2. In the Search region, complete the fields as shown in this table.

Field Name

Search Task

Name Import Worker Users

3. Click Search.

4. In the search results, click Go to Task for the task Import Worker Users.

The Initiate Spreadsheet Load page opens.

Alternatively, you can select the Import Worker Users task from animplementation project.

Creating the Spreadsheet

1. On the Initiate Spreadsheet Load page, find the entry for Create Worker inthe list of business objects.

Create Worker appears after other business objects such as departments,locations, and jobs. Those business objects must be created before workerusers, regardless of how you create them.

2. Click Create Spreadsheet for the Create Worker entry.

3. When prompted, save the spreadsheet locally using the nameWorkers042713Batch01.xlsx.

4. When prompted, sign in to Oracle Fusion Applications using your OracleFusion user name and password.


Entering Worker Data in the Spreadsheet

1. In the Batch Name field of the spreadsheet Workers042713Batch01.xlsx,replace the default batch name with the batch nameWorkers042713Batch01.

2. If your data includes flexfields, click Configure Flexfield to configureflexfield data. Otherwise, go to step 5 of this task.

3. In the Configure Flexfield window, select an attributes value and clickOK.

4. See the Flexfields Reference tab for information about the configuredflexfield.

5. Enter worker data in the spreadsheet.

Ensure that you provide any required values and follow instructions inthe spreadsheet for creating rows.

Importing Worker Data and Correcting Import Errors

Use the default values except where indicated.

1. In the workers spreadsheet, click Upload.

2. In the Upload Options window, click OK.

As each row of data is uploaded to the Load Batch Data stage tables, itsstatus is updated.

3. When uploading completes, identify any spreadsheet rows with the statusInsert Failed, which indicates that the row was not imported to the stagetables.

4. For any row that failed, double-click the status value to display adescription of the error.

5. Correct any import errors and click Upload again to import the remainingrows to the same batch.

As rows are imported successfully to the stage tables, the data is loadedautomatically to the application tables.

Reviewing and Correcting Load Errors

1. In the spreadsheet, click Refresh to display latest load status.

Any errors that occur during the load process are reported in thespreadsheet.

2. Correct any load errors in the spreadsheet.

3. Repeat this process from Importing Worker Data and CorrectingImport Errors until all spreadsheet rows are both imported and loadedsuccessfully.

4. Close the spreadsheet.

To load a second batch of worker users on the same date, incrementthe batch number in the spreadsheet and batch names (for example,Workers042713Batch02).


Manage Users

Creating Users: Worked Example

You can create users by entering basic person and employment data. A useraccount is created automatically for a person when you create the user record.You can assign the users Oracle Fusion Human Capital Management (HCM) andnon-HCM data roles, each providing access to specific functions and data. Thisexample demonstrates how to create a user and assign roles to the user.

Note

This user management functionality is available for HCM Foundation andOracle Fusion Workforce Directory Management (WDM) users only.

Decisions to Consider In this Example

For whom are you creating the user record? Gail Williams

What is the user account name? Same as the e-mail ID, [email protected]

Where is Gail employed? Gail is an employee of Vision Corporation, andworks in the Human Resources (HR) department inthe Canada office.

What roles must be provisioned to Gail? Autoprovision the employee role. Gail is responsiblefor processing workers' expense claims so provisionthe role Expense Claims Administrator manually toGail.

Prerequisites

1. Create a role mapping called All Employees and enter the followingconditions.

Attribute Value



In the role mapping you include the:

• Employee role, and select the Autoprovision option

• Expense Claims Administrator role, and select the Self-requestableoption

Creating a User

1. On the Search Person page, click the Create icon to open the Create Userpage.

2. Complete the fields, as shown in this table:


Field Value

Last Name Williams

First Name Gail

E-Mail [email protected]

Hire Date 4/12/11

3. In the User Details region, leave the User Name field blank. The username defaults to the user's e-mail ID.

4. In the Employment Information region, select the person type Employeeand complete the fields as shown in the table:

Field Value

Legal Employer Vision Corporation

Business Unit Vision Canada

Department Human Resources

Assigning Roles to the User

1. Click Autoprovision Roles to provision the employee role to the user.

2. Click Add Role.

3. Search for and select the Expense Claims Administrator role.

4. Click Save and Close. The user account is created and the roles areassigned to the user immediately.

Changing User Names: Explained

You can change user names for both new and existing users.

Changing User Names When Creating Users

When you create a user using the Create User interface, the User Name field maybe blank. If you leave it blank, then the user name is generated in the enterprisedefault format when you save the user.

Alternatively, you can enter a user name on the Create User page, regardless ofwhether the field is blank. Any name that you enter replaces the default username.

The user is notified of the user name only if user notifications are enabled andthe user has not yet been notified of any user name and password.

Changing Existing User Names

You can change an existing user name on the Manage User Account and EditUser pages. The new name is sent automatically to Oracle Identity Management.However, it becomes visible in Oracle Fusion Applications only after the usersigns in for the first time using the new name.


When you change an existing user name:

• The password is unchanged.

• Roles provisioned to the user are unchanged.

• The user is not notified automatically of the new name.

You are recommended to send details of the new user name to the user.

User Details System Extract Report

The Oracle BI Publisher User Details System Extract Report includes details ofsome or all Oracle Fusion Applications user accounts.

To run this report, you must have an HCM data role that provides view-allaccess to person records for the Human Capital Management ApplicationAdministrator job role.

To run the report:

1. Navigate to Tools - Reports and Analytics.

2. In the Contents pane of the Reports and Analytics work area, navigate toShared Folders - Human Capital Management - Workforce Management- Human Resources Dashboard.

3. Select the User Details System Extract report.

4. In the report window, click More.

5. On the Oracle Business Intelligence page for the report, select Open to runthe report immediately or Schedule to schedule the report.

Parameters

User Population

Enter one of the following values to identify the group of user accounts toinclude in the report.

Value Description

HCM User accounts with an associated HCMperson record.

TCA User accounts with an associated TCAparty account.

OIM Accounts for users in the PER_USERS tablewho do not have an associated personnumber or party ID. OIM users are alsoreferred to as implementation users.

ALL HCM, TCA, and OIM users accounts.

From Date

Accounts for HCM and OIM users created on or after this date are included inthe report. If you specify no From Date value, then accounts with any creationdate are included, subject only to any To Date value that you specify.


From and to dates do not apply to the TCA user population; the report includesall TCA users if you include them in the report's user population.

To Date

Accounts for HCM and OIM users created on or before this date are included inthe report. If you specify no To Date value, then accounts with any creation dateare included, subject only to any From Date value that you specify.

From and to dates do not apply to the TCA user population; the report includesall TCA users if you include them in the report's user population.

User Active Status

Enter one of the following values to identify the user-account status.

Value Description

A Include active accounts, which belong tousers with current roles.

I Include inactive accounts, which belong tousers with no current roles.

All Include both active and inactive useraccounts.

Report Results

The output is an XML-formatted file where user accounts are grouped by type,as follows:

• Group 1 (G_1) includes HCM user accounts.

• Group 2 (G_2) includes TCA party user accounts.

• Group 3 (G_3) includes OIM user accounts.

The information provided in the extract varies with the account type.

HCM User Accounts

Business Unit Name

The business unit from the primary work relationship.

Composite Last Update Date

The date when any one of a number of values, including assignment managers,location, job, and person type, was last updated.

Department

The department from the primary assignment.

Worker Type

The worker type from the user's primary work relationship.


Generation Qualifier

The user's name suffix (for example, Jr., Sr., or III).

Hire Date

The enterprise hire date.

Role Name

A list of roles currently provisioned to workers whose work relationships are allterminated. This value appears for active user accounts only.

Title

The job title from the user's primary assignment.

TCA User Accounts

Organizations

A resource group.

Roles

A list of job, abstract, and data roles provisioned to the user.

Managers

The manager of a resource group.

OIM User Accounts

Start Date

The date from when the account existed.

Created By

The user name of the user who created the account.

FAQs for Manage Users

What happens if I send the user name and password?

An e-mail containing the user name and password is sent to the user's primarywork e-mail address. If the user has no primary work-email address, then theuser name and password are sent to the primary work e-mail address of theuser's line manager, if available; otherwise, no notification is sent.

You can select Send user name and password only if these details have notalready been sent for this user: the user name and password can be sent


once only for any user. If this option is available for selection but you do notselect it, then you can run the process Send User Name and Password E-MailNotifications later to notify users of their user names and passwords.

What happens when I autoprovision roles?

When you autoprovision roles to a user, the user's assignments are reviewedautomatically against all current role mappings.

Roles for which the Autoprovision option is selected are:

• Provisioned to the user immediately, if the user is eligible for the role anddoes not currently have it

• Deprovisioned from the user immediately, if the user is no longer eligiblefor the role but currently has it

You are recommended to autoprovision roles to individual users if you knowthat new or changed role mappings exist for which those users are eligible.Otherwise, roles are not provisioned or deprovisioned automatically until theuser's assignments are next updated.

Where do default user names come from?

By default, user names are defined by Oracle Identity Management (OIM). Theuser name is typically the user's first and last names, but this format can bechanged in OIM.

The default format of user names can be specified for the enterprise in OracleFusion HCM. This setting overrides the OIM default format. Your enterprisemay have selected one of the following values:

• Person number

• Party number

• Primary work e-mail

If the default user-name format for the enterprise is the person number, thenprimary e-mail is used instead for party users who have no person number.

Default user names may not appear for new users until the relevant value(for example, the person number) is available. The user-account request is notsubmitted to OIM until the value exists.

What happens when I link a user account?

The current person or party record is linked to the selected Oracle IdentityManagement (OIM) user account. When you click Save, the request is submittedto OIM and the account status is Requested. Once the account status is Active,the user can sign in using the account.

Any roles currently provisioned to the linked account do not appear in the Rolessection of the page until the account status is Active. However, you can add rolesbefore clicking Save.


The Link User Account action appears only for persons or party users whoserecords are not already linked to a user account. When you link a user account,the person or party is not notified automatically. You are recommended to notifythe user when the account is linked.

Can I extract details of all Oracle Fusion Applications users?

Yes. The Oracle BI Publisher User Details System Extract report includes detailsof all user accounts or a specified subset. For example, you can produce a reportshowing inactive user accounts, accounts created between specified dates, oraccounts associated with TCA parties only.

To run the report, you must have an HCM data role that provides view-allaccess to person records for the Human Capital Management ApplicationAdministrator job role.

Define Security 3-1

3Define Security

Security Tasks: Highlights

Security tasks include the following.

• Security setup

• Security implementation and administration

Note

Security setup and administration tasks typically use integrated user interfacepages that are provided by the following products.

• Oracle Identity Manager (OIM)

• Oracle Authorization Policy Manager (APM)

• Oracle Fusion Human Capital Management (HCM) products

• Oracle Application Access Control Governor (AACG) in Oracle EnterpriseGovernance, Risk and Compliance (GRC)

Security setup and administrative tasks performed by product administratorsand implementation consultants, such as managing HCM security profiles, arepresented in the documentation for those products.

Set Up the IT Security Manager Job Role

Provision the IT Security Manager job role with roles for user and rolemanagement.

• Using the OIM Administrator user name and password, sign in toOracle Identity Manager (OIM). Refer to the Oracle Fusion MiddlewareEnterprise Deployment Guide for Oracle Identity Management.

See: Creating Users and Groups

• Open the IT Security Manager job role's attributes and use theHierarchy tab to add the User Identity Administrators role and the RoleAdministrators role in the OIM Roles category using the Add action.Use the Delegated Administration menu to search for the Xellerate Usersorganization and assign it to the IT Security Manager role. Refer to theOracle Fusion Middleware User's Guide for Oracle Identity Manager.

See: User Management Tasks

Prerequisite Tasks for Security Administration

Sign into Oracle Fusion Applications for the first time with the Installation SuperUser account to synchronize LDAP users with HCM user management and


create an IT security manager user account and provision it with the IT SecurityManager role. For environments that are not in Oracle Cloud, use the super useraccount that was created during installation to sign in for the first time.

• Installation establishes the super user account. Refer to the Oracle FusionApplications Installation Guide.

See: Identity Management Configuration

• Oracle provides an initial user for accessing your services in OracleCloud. For more information, refer to "Oracle Cloud Application ServicesSecurity: Explained" in Oracle Cloud documentation.

• Synchronize LDAP users with HCM user management by performing theRun User and Roles Synchronization Process task. Monitor completion ofthe predefined Enterprise Scheduler process called Retrieve Latest LDAPChanges.

• Refer to information about creating person records in Oracle FusionApplications Workforce Development Implementation Guide, or refer tothe Oracle Fusion Middleware User's Guide for Oracle Identity Manager.

See: Managing Users

• As a security guideline, provision a dedicated security professionalwith the IT Security Manager role as soon as possible after initialsecurity setup and revoke that role from users provisioned with theApplication Implementation Consultant role. If entitled to do so, seeSecurity Tasks and Oracle Fusion Applications: How They Fit Togetherfor details about provisioning the IT security manager.

Required Security Administration Tasks

Establish at least one implementation user and provision that user with sufficientaccess to set up the enterprise for all integrated Oracle Fusion Middleware andall application pillars or partitions.

• Perform the initial security tasks. If entitled to do so, see Initial SecurityAdministration: Critical Choices.

• Sign in to Oracle Fusion Applications using the IT security manager'sor administrator's user name and password, and create and provisionusers who manage your implementation projects and set up enterprisestructures by performing the Create Implementation Users task. Referto the Oracle Fusion Middleware User's Guide for Oracle IdentityManager.

See: User Management Tasks

• Create a data role for implementation users who will set up HCM thatgrants access to data in secured objects required for performing HCMsetup steps. Provision the implementation user with this View All datarole. See "Creating an HCM Data Role: Worked Example."

• For an overview of security tasks from the perspective of an applicationsadministrator, refer to the Oracle Fusion Applications Administrator'sGuide

See: Securing Oracle Fusion Applications

Define Security 3-3

Optional Security Administration Tasks

Once initial security administration is complete and your enterprise is set upwith structures such as business units, additional security administration tasksare optional and based on modifying and expanding the predefined securityreference implementation to fit your enterprise. See points to consider fordefining security, data security and trading partner security after enterprisesetup.

• Create users. Refer to the Oracle Fusion Middleware User's Guide forOracle Identity Manager.

See: Creating Users

• Provision users with roles. Refer to the Oracle Fusion Middleware User'sGuide for Oracle Identity Manager.

See: Adding and Removing Roles

• You manage users and job roles, including data and abstract roles, inOracle Identity Management user interface pages. Refer to the OracleFusion Middleware User's Guide for Oracle Identity Manager.

See: User Interfaces

• You manage duties, security policies, and data role templates in theAuthorization Policy Manager. Refer to the Oracle Fusion MiddlewareAuthorization Policy Manager Administrator's Guide.

See: Managing Oracle Fusion Applications Data Security Policies

• You manage role provisioning rules in Human Capital Management(HCM). Refer to the Role Mappings: Explained topic in the OracleFusion Applications Workforce Development Implementation Guide.

See: Common Applications Configuration: Define Security for HumanCapital Management

• For a complete description of the Oracle Fusion Applications securityreference implementation, see the Oracle Fusion Applications SecurityReference Manuals for each offering.

See: Oracle Fusion Applications Common Security Reference Manual

• For a detailed functional explanation of the Oracle Fusion Applicationssecurity approach, refer to the following guides.

See: Oracle Fusion Applications Security Guide

See: Oracle Fusion Applications Security Hardening Guide

• Since security in Oracle Fusion Applications is based on integrationswith Oracle Identity Management in Fusion Middleware, securityfeatures in the database, and Oracle Enterprise Governance, Risk andCompliance (GRC), additional resources in support of performingsecurity tasks include the following.

• Authorization Policy Manager (APM) is available in Oracle FusionApplications through integration with Oracle Identity Management


(OIM). Authorization policy management involves managingduty roles, data role templates, and data security policies. Referto the Oracle Fusion Middleware Authorization Policy ManagerAdministrator's Guide.

See: Getting Started With Oracle Authorization Policy Manager

• Oracle Identity Management (OIM) is available in Oracle FusionApplications through integration with Oracle Fusion Middleware.Identity management in Oracle Fusion Application involves creatingand managing user identities, creating and linking user accounts,managing user access control through user role assignment,managing enterprise roles, and managing workflow approvals anddelegated administration.

See: Oracle Fusion Middleware User's Guide for Oracle IdentityManager

• Oracle Fusion Applications is certified to integrate with ApplicationsAccess Controls Governor (AACG) in the Oracle EnterpriseGovernance, Risk and Compliance (GRC) suite to ensure effectivesegregation of duties (SOD).

See: Oracle Application Access Controls Governor Users Guide

See: Oracle Application Access Controls Governor ImplementationGuide

• Configure and manage auditing. Refer to the Oracle Fusion MiddlewareApplication Security Guide.

See: Configuring and Managing Auditing

Defining Security After Enterprise Setup: Points to Consider


The Define Security activity within the Information Technology (IT)Management business process includes the following tasks.

• Import Worker Users

• Import Partner Users


• Manage Duties

• Manage Application Access Controls

If no legacy users, user accounts, roles, and role memberships are available in theLightweight Directory Access Protocol (LDAP) store, and no legacy workers areavailable in Human Resources (HR), the implementation user sets up new usersand user accounts and provisions them with roles available in the Oracle FusionApplications reference implementation.

If no legacy identities (workers, suppliers, customers) exist to represent peoplein your enterprise, implementation users can create new identities in HumanCapital Management (HCM), Supplier Portal, and Customer RelationshipManagement (CRM) Self Service, respectively, and associate them with users.

Define Security 3-5

Before Importing Users

Oracle Identity Management (OIM) handles importing users.

If legacy employees, contingent workers, and their assignments exist, the HCMApplication Administrator imports these definitions by performing the InitiateHCM Spreadsheet Load task. If user and role provisioning rules have beendefined, the Initiate HCM Spreadsheet Load process automatically creates userand role provisioning requests as the workers are created.Once the enterprise is set up, performing the Initiate HCM Spreadsheet Loadtask populates the enterprise with HR workers in records linked by global userID (GUID) to corresponding user accounts in the LDAP store. If no user accountsexist in the LDAP store, the Initiate HCM Spreadsheet Load task results in newuser accounts being created. Worker email addresses as an alternate input forthe Initiate HCM Spreadsheet Load task triggers a search of the LDAP for userGUIDs, which may perform more slowly than entering user names.In the security reference implementation, the HCM Application Administratorjob role hierarchy includes the HCM Batch Data Loading Duty role, whichis entitled to import worker identities. This entitlement provides the accessnecessary to perform the Initiate HCM Spreadsheet Load task in HCM.

Note

The Import Person and Organization task in the Define Trading CommunityImport activity imports the following resources, creates users, and links theresources to users for use in CRM.

• Internal employees• Contingent workers• External partner contacts• Partner companies• Legal entities• Customers• Consumers

If role provisioning rules have been defined, the Import Person and Organizationtask automatically provisions role requests as the users are created.

Import Users

If legacy users (identities) and user accounts exist outside the LDAP store thatis being used by the Oracle Fusion Applications installation, the IT securitymanager has the option to import these definitions to the LDAP store byperforming the Import Worker Users and Import Partner Users tasks.If no legacy users or user accounts can be imported or exist in an LDAPrepository accessible to Oracle Identity Management (OIM), the IT securitymanager creates users manually in OIM or uses the Initiate HCM SpreadsheetLoad task to create users from imported HR workers.Once users exist, their access to Oracle Fusion Applications is dependent onthe roles provisioned to them in OIM or Human Capital Management. Use theManage HCM Role Provisioning Rules task to define rules that determine whatroles are provisioned to users.

Importing user identities from other applications, including other OracleApplications product lines, is either a data migration or manual task. Migratingdata from other Oracle Applications includes user data. For more informationabout importing users, see the Oracle Fusion Middleware Developer's Guide forOracle Identity Manager.


In the security reference implementation, the IT Security Manager job rolehierarchy includes the HCM Batch Data Loading Duty and the Partner AccountAdministration Duty. These duty roles provide entitlement to import or createusers. The entitlement Load Batch Data provides the access necessary toperform the Import Worker Users task in OIM. The entitlement Import Partnerentitlement provides the access necessary to perform the Import Partner Userstask in OIM.

Manage Job Roles

Job and abstract roles are managed in OIM. This task includes creating andmodifying job and abstract roles, but not managing role hierarchies of duties forthe jobs.

Note

Manage Job Roles does not include provisioning job roles to users. Provisioningusers is done in OIM, HCM, CRM or Oracle Fusion Supplier Portal.

Roles control access to application functions and data. Various types of rolesidentify the functions performed by users.

The Oracle Fusion Applications security reference implementation providespredefined job and abstract roles. In some cases, the jobs defined in yourenterprise may differ from the predefined job roles in the security referenceimplementation. The predefined roles and role hierarchies in Oracle Fusionmay require changes or your enterprise may require you to create new roles.For example, you need a job role for a petty cash administrator, in addition toan accounts payable manager. The security reference implementation includesa predefined Accounts Payable Manager, and you can create a petty cashadministrator role to extend the reference implementation.

In the security reference implementation, the IT Security Manager job rolehierarchy includes the Enterprise Role Management Duty role, which is entitledto manage job and abstract roles (the entitlement is Manage Enterprise Role).This entitlement provides the access necessary to perform the Manage Job Rolestask in OIM.

Manage Duties

A person with a job role must be able to perform certain duties. In the OracleFusion Applications security reference implementation, enterprise roles inheritduties through a role hierarchy. Each duty corresponds to a duty role. Duty rolesspecify the duties performed within applications and define the function anddata access granted to the enterprise roles that inherit the duty roles.

Managing duties includes assigning duties to job and abstract roles in a rolehierarchy using Authorization Policy Manager (APM). If your enterprise needsusers to perform some actions in applications coexistent with Oracle Fusionapplications, you may wish to remove the duty roles that enable those actions.For details about which duty roles are specific to the products in an offering, seethe Oracle Fusion Applications Security Reference Manual for each offering.

OIM stores the role hierarchy and the spanning of roles across multiple pillars orlogical partitions of applications.

In cases where your enterprise needs to provide access to custom functions,it may be necessary to create or modify the duty roles of the referenceimplementation.

Define Security 3-7

Tip


In the security reference implementation, the IT Security Manager job rolehierarchy includes the Application Role Management Duty role, which isentitled to manage duty roles (the entitlement is Manage Application Role). Thisentitlement provides the access necessary to perform the Manage Duties task inAPM.

Note

Product family administrators are not entitled to create role hierarchies ormanage duty roles and must work with the IT security manager to make changessuch as localizing a duty role to change a role hierarchy. Setup for localizations isdocumented in HCM documentation.

Manage Application Access Controls

Prevent or limit the business activities that a single person may initiate orvalidate by managing segregation of duties policies in the Application AccessControls Governor (AACG) .

Note

In AACG, segregation of duties policies are called access controls or segregationof duties controls.

In the security reference implementation, the IT Security Manager job rolehierarchy includes the Segregation of Duties Policy Management Duty role,which is entitled to manage segregation of duties policies (the entitlement isManage Segregation of Duties Policy). This entitlement provides the accessnecessary to perform the Manage Application Access Controls task in AACG.

Security Tasks and Oracle Fusion Applications: How They Fit

Together

The major security tasks and their order within the context of an overall OracleFusion Applications implementation extend from security setup throughproduction deployment audits.

The Oracle Fusion business process model (BPM) provides a sequence of securityimplementation tasks that includes the following.

• Security setup (Define Common Applications Configuration activity)

• Define Implementation Users task group (optional)

• Create Implementation Users task

• Create Data Role for Implementation Users task

• Provision Roles to Implementation Users task


• Define security - tasks vary depending on deployed Oracle Fusionproduct family

• Revoke Data Role from Implementation Users task

• Import Worker Users task

• Import Partner Users task

• Manage Duties task

• Manage Job Roles task

• Manage Application Access Controls task

• Define Automated Governance, Risk, and Performance Controlsactivity

• Manage Application Access Controls task (AACG settings)

• Manage Application Preventive Controls task

• Manage Application Transaction Controls task

• Manage Application Configuration Controls task

• User and role provisioning tasks

• Implement Role Request and Provisioning Controls activity



• Self Request User Roles task

• Approve User and Role Provisioning Requests task

• Assign User Roles task

• Manage Supplier User Roles and User Role Usages task

• Map and Synchronize User Account Details task

• Tasks for viewing account details for self or others

• Tasks for applying and managing various role provisioning rules

• Tasks for running synchronization processes

• Security implementation and ongoing maintenance after setup (ManageIT Security activity)

• Implement Function Security Controls

• Create Job Role task


Define Security 3-9


• Manage Duties task

• Manage Job Roles task

• Manage Users task

• Implement Data Security Controls

• Manage Data Security Policies task

• Manage Role Templates task

• Manage Segment Security task

• Manage Data Access Sets task

• Define Security Profiles task group

• Auditing tasks

• Manage Security Audit, Compliance and Reporting activity

• Manage Application Access Controls task

Note

Go live deployment does not require lockdown or specific security tasks becausesecurity is enforced across the test to production information life cycle.

Required RolesThe following enterprise roles are provisioned to a single super user that is setup by the Oracle Fusion Applications installation process, and to the initial userset up by Oracle for Oracle Cloud Application Services:


• IT Security Manager

• Application Administrators for the provisioned products

Initial security administration also includes provisioning the IT SecurityManager role with Oracle Identity Management (OIM) roles for user and rolemanagement.

• Identity User Administrator

• Role Administrator

Additionally, the Xellerate Users organization must be assigned to the ITSecurity Manager role.

Important

As a security guideline, provision a dedicated security professional with the ITSecurity Manager role at the beginning of an implementation, and revoke thatrole from users provisioned with the Application Implementation Consultantrole.

Tools Used to Perform Security TasksSecurity tasks are supported by tools within both Oracle Fusion Applicationsand Oracle Fusion Middleware.

The figure lists the tasks associated with each of the integrated products andpillars of an Oracle Fusion Applications deployment.


Security Tasks: Overview

Security tasks span multiple business processes and are performed by variousroles using numerous integrated tools.The following table shows the business process model (BPM) tasks and toolsused to support securing Oracle Fusion Applications.

Example Task Oracle BPM Task Supporting Tools Details

View duty roles inheritedby a job role

Manage Duties • AuthorizationPolicy Manager(APM)

Each logical partitionor pillar contains acollection of applicationroles, and function anddata security policies.

View entitlement orpolicies carried by a jobrole

Manage Duties • APM In LDAP, the policy storestores application rolesand the identity storestores enterprise roles.

Add a job role to a rolehierarchy

Manage Job Roles • Oracle IdentityManagement(OIM)

The identity store inLDAP stores enterpriseroles.

Add a duty role to a rolehierarchy

Manage Duties • APM LDAP stores the rolehierarchy and thespanning of roles acrossmultiple pillars or logicalpartitions.

Define Security 3-11

Create a hierarchy ofenterprise (abstract, job,data) roles

Manage Job Roles • OIM

Create a hierarchy of(application) duty roles

Manage Duties • APM

Create a new job role Manage Job Roles • OIM The identity store inLDAP stores enterpriseroles.

Change duty rolesinherited by a job orabstract role

Manage Duties • APM The policy store storesduty roles. The identitystore stores enterpriseroles. Some duty rolesmay enable actionsand their associatedusers interface featuresthat your enterprisedoes not want users toperform in Oracle Fusionapplications.

Create a new duty role Manage Duties • APM All functions andactions in Oracle FusionApplications thatneed to be secured arecovered by the referenceimplementation. In somecases, especially withfunction customizations,a new duty role may beneeded.

View Segregation ofDuties (SOD) policiesrespected by a duty role

Manage ApplicationAccess Controls

• Application AccessControls Governor(AACG) inOracle EnterpriseGovernance, Riskand Compliance(GRC)

The Security ReferenceManuals (SRM)document thesegregation of duties(SOD) policies respectedwithin each job role

View SOD policyviolations carried by theduty roles inherited by ajob role

Manage ApplicationAccess Controls

• AACG in GRC The Security ReferenceManuals (SRM)document the SODpolicies respected withineach job role

View SOD policyviolations

Manage Segregation ofDuties Policies

• AACG in GRC The SRM documents theSOD conflicts for eachjob role

View the data securitypolicies carried by a job,abstract, and data roles

Manage Data SecurityPolicies

• APM Oracle Fusion DataSecurity stores datasecurity policies in thepolicy store.

Data security canalso be defined inapplication pagesprovided by OracleMiddleware Extensionsfor Applications (FND)


Create and update HCMsecurity profiles

Manage Data Role andSecurity Profiles

• Oracle FusionHCM

This task does notinclude assigning dataroles to the users, whichis supported by userprovisioning tasks.

Create (generate) a datarole

1. Manage RoleTemplates

2. Manage DataRoles and SecurityProfiles

• APM


Data roles are generatedautomatically basedon data role templatesand enterprise setup.Changes to data roletemplates generate newor changed data roles.

Create data roles inHCM using the ManageData Roles and SecurityProfiles task.

Create a new datasecurity policy (notthrough generated dataroles based on datarole templates or HCMsecurity profiles)


• APM Data security canalso be defined inapplication pagesprovided by OracleMiddleware Extensionsfor Applications (FND)

View data role templatesdefined by a product

Manage Role Templates • APM

Create or edit an existingdata role template

Manage Role Templates • APM

Secure common objectssuch as attachmentcategories or profileoptions


• APM Data security canalso be defined inapplication pagesprovided by OracleMiddleware Extensionsfor Applications (FND)

View, create, updateData Access Sets usedto secure Ledgers andLedger Sets

Manage Data Access Sets • Oracle FusionGeneral Ledger

View, create, updateaccounting flexfieldsegment security rules

Manage SecuritySegments

• Oracle FusionGeneral Ledger

View or update the setof job roles that can beprovisioned to supplierusers

Manage Supplier UserRole

• Supplier Portal

• Sourcing

These tools are inthe Oracle FusionProcurement productfamily

Determine the supplierjob roles that the supplierself service administratorcan provision to supplierusers

Manage Supplier UserRole Usages

• Supplier Portal

• Sourcing


Set default supplier jobroles based on the set ofsupplier roles that aredefined by performingthe Manage SupplierUser Roles task

Manage Supplier UserRole Usages

• Supplier Portal

• Sourcing



Create a newimplementation user

Create ImplementationUsers

• OIM

Import legacy users • Import WorkerUsers

• Import PartnerUsers

• OIM

Create a new user Manage Users • HCM HCM creates a new userand identity when a newworker is created. TheHire Employee and AddContingent Worker tasksalso result in new usercreation requests.

Creating a new userautomatically triggersrole provisioningrequests based on roleprovisioning rules.

Provision roles to a user 1. Provision Roles toImplementationUsers

2. Manage Users

• OIM


• Oracle FusionCRM

• Oracle FusionSuppliers

Implementation usersare provisioned throughOIM since HCM is notsetup at the start ofthe implementation.The Provision Rolesto ImplementationUsers is not neededonce implementation iscomplete.

Once HCM is setup,HCM is used toprovision roles to non-implementation usersby performing theManage Users task.Human Resources (HR)transaction flows such asHire and Promote alsoprovision roles.

Once supplier usersare setup, SupplierModel can be used byinternal users to maintainsupplier user accountsor supplier users canmaintain their accountsin Supplier Portal.


View the job, abstract,and data rolesprovisioned to a user

1. Manage Users

2. Manage UserPrincipal

3. Provision Roles toImplementationUsers

• Human CapitalManagement(HCM)

• OIM

LDAP stores users,roles and provisioninginformation.

The Manage UserPrincipal and ProvisionRoles to ImplementationUsers tasks arenot needed onceimplementation iscomplete.

Revoke role from user. Manage Users • HCM You can revoke rolesfrom various HumanResources task flows,the HCM Manage Userstask and OIM. Usertermination includes rolerevocation.

Approve roleprovisioning or useraccount request.

Approve User and RoleProvisioning Requests

• OIM

View audit logs Not applicable • Oracle EnterpriseManager

Viewing audit logsis a Oracle FusionMiddleware functionand not representedby an Oracle FusionApplications BPM task.

For more information about provisioning identities and configuring auditpolicies, see the Oracle Fusion Applications Administrator's Guide.

There may be more than one navigation path to the graphical user interface inwhich the task is performed. You can access most security tasks by starting in theSetup and Maintenance Overview page and searching for security tasks and tasklists.

Define Data Security

Data Security: Explained

By default, users are denied access to all data.

Data security makes data available to users by the following means.

• Policies that define grants available through provisioned roles

• Policies defined in application code

You secure data by provisioning roles that provide the necessary access.Enterprise roles provide access to data through data security policies defined forthe inherited application roles.


When setting up the enterprise with structures such as business units, data rolesare automatically generated that inherit job roles based on data role templates.Data roles also can be generated based on HCM security profiles. Data roletemplates and HCM security profiles enable defining the instance sets specifiedin data security policies.

When you provision a job role to a user, the job role implicitly limits dataaccess based on the data security policies of the inherited duty roles. When youprovision a data role to a user, the data role explicitly limits the data access of theinherited job role to a dimension of data.

Data security consists of privileges conditionally granted to a role and usedto control access to the data. A privilege is a single, real world action on asingle business object. A data security policy is a grant of a set of privilegesto a principal on an object or attribute group for a given condition. A grantauthorizes a role, the grantee, to actions on a set of database resources. Adatabase resource is an object, object instance, or object instance set. Anentitlement is one or more allowable actions applied to a set of databaseresources.

Data is secured by the following means.

Data security feature Does what?

Data security policy Grants access to roles by means of entitlement

Role Applies data security policies with conditions tousers through role provisioning.

Data role template Defines the data roles generated based on enterprisesetup of data dimensions such as business unit.

HCM security profile Defines data security conditions on instances ofobject types such as person records, positions, anddocument types without requiring users to enterSQL code

Masking Hides private data on non-production databaseinstances

Encryption Scrambles data to prevent users without decryptionauthorization from reading secured data

The sets of data that a user can access via roles are defined in Oracle Fusion DataSecurity. Oracle Fusion Data Security integrates with Oracle Platform SecurityServices (OPSS) to entitle users or roles (which are stored externally) with accessto data. Users are granted access through the entitlement assigned to the rolesor role hierarchy with which the user is provisioned. Conditions are WHEREclauses that specify access within a particular dimension, such as by businessunit to which the user is authorized.

Data Security Policies

Data security policies articulate the security requirement "Who can do Whaton Which set of data," where 'Which set of data' is an entire object or an objectinstance or object instance set and 'What' is the object entitlement.

For example, accounts payable managers can view AP disbursements for theirbusiness unit.


Who can do what on which set of data

Accounts payablemanagers

view AP disbursements for their business unit

A data security policy is a statement in a natural language, such as English, thattypically defines the grant by which a role secures business objects. The grantrecords the following.

• Table or view

• Entitlement (actions expressed by privileges)

• Instance set (data identified by the condition)

For example, disbursement is a business object that an accounts payablemanager can manage by payment function for any employee expenses in thepayment process.

Note

Some data security policies are not defined as grants but directly in applicationscode. The security reference manuals for Oracle Fusion Applications offeringsdifferentiate between data security policies that define a grant and data securitypolicies defined in Oracle Fusion applications code.

A business object participating in a data security policy is the database resourceof the policy.

Data security policies that use job or duty roles refer to data security entitlement.

For example, the data security policy for the Accounts Payable Manager job rolerefers to the view action on AP disbursements as the data security entitlement.

Important

The duty roles inherited by the job role can be moved and job roles reassembledwithout having to modify the data security.

As a security guideline, data security policies based on user session contextshould entitle a duty role. This keeps both function and data security policies atthe duty role level, thus reducing errors.

For example, a Sales Party Management Duty can update Sales Party wherethe provisioned user is a member of the territory associated with the salesaccount. Or the Sales Party Management Duty can update Sales Party wherethe provisioned user is in the management chain of a resource who is on thesales account team with edit access. Or the Participant Interaction ManagementDuty can view an Interaction where the provisioned user is a participant of theInteraction.

For example, the Disbursement Process Management Duty role includesentitlement to build documents payable into payments. The Accounts PayableManager job role inherits the Disbursement Process Management Duty role. Datasecurity policies for the Disbursement Process Management Duty role authorizeaccess to data associated with business objects such as AP disbursements within


a business unit. As a result, the user provisioned with the Accounts PayableManager job role is authorized to view AP disbursements within their businessunit.

A data security policy identifies the entitlement (the actions that can be made onlogical business objects or dashboards), the roles that can perform those actions,and the conditions that limit access. Conditions are readable WHERE clauses.The WHERE clause is defined in the data as an instance set and this is thenreferenced on a grant that also records the table name and required entitlement.

Data Roles

Data roles are implemented as job roles for a defined set of data.

A data role defines a dimension of data within which a job is performed. Thedata role inherits the job role that describes the job. For example, a data roleentitles a user to perform a job in a business unit.

The data role inherits abstract or job roles and is granted data security privileges.Data roles carry the function security privileges inherited from job roles and alsothe data security privilege granted on database objects and table rows.

For example, an accounts payables specialist in the US Business Unit may beassigned the data role Accounts Payables Specialist - US Business Unit. Thisdata role inherits the job role Accounts Payables Specialist and grants access totransactions in the US Business Unit.

A data role may be granted entitlement over a set people.

For example, a Benefits Administrator A-E is allowed to administer benefits forall people that have a surname that begins with A-E.

Data roles are created using data role templates. You create and maintain dataroles in the Authorization Policy Manager (APM). Use the Manage Data Rolesand Security Profiles task to create and maintain HCM data roles in OracleFusion HCM.

HCM Security Profiles

HCM security profiles are used to secure HCM data, such as people anddepartments. You use HCM security profiles to generate grants for an enterpriserole. The resulting data role with its role hierarchy and grants operates in thesame way as any other data role.

For example, an HCM security profile identifies all employees in the Financedivision.

Applications outside of HCM can use the HCM Data Roles UI pages to give theirroles access to HR people.

Masking and Encryption

Oracle Fusion Applications uses masking to protect sensitive data from view byunauthorized users. Encryption APIs mask sensitive fields in applications userinterfaces. Additionally, Oracle Data Masking is available for masking data in


non-production instances and Oracle Transparent Data Encryption is availablefor protecting data in transit or in backups independent of managing encryptionkeys.

Defining Data Security After Enterprise Setup: Points to Consider


The Define Data Security activity within the Information Technology (IT)Management business process includes the following tasks.

• Manage Data Access Sets

• Manage Segment Security

• Manage Role Templates

• Manage Data Security Policies

These tasks address data security administration. For information on using theuser interface pages for setting up and managing data security, see the OracleFusion Middleware Administrator's Guide for Authorization Policy Manager.

Note

The Manage Data Role and Security Profiles task, and all other HCM securityprofile setup tasks are documented in Human Capital Management (HCM)documentation.

Manage Data Access Sets

Data access sets define a set of access privileges to one or more ledgers or ledgersets.

The information on ledgers that are attached to data access sets are secured byfunction security. Users must have access to the segment values associated withthe data access sets to access the corresponding GL account.

In the security reference implementation, the IT Security Manager job rolehierarchy includes the Data Access Administration Duty role, which is entitledto manage data access sets (the entitlement is Define General Ledger Data AccessSet). This entitlement provides the access necessary to perform the Manage DataAccess Sets task in General Ledger.

Manage Segment Security

Balancing or management segment values can secure data within a ledger.


Segment values are stored in GL_ACCESS_SET_ASSIGNMENTS and secured byrestrictions, such as Exclude, on parameters that control the set of values that auser can use during data entry.

In the security reference implementation, the IT Security Manager job rolehierarchy includes the Application Key Flexfield Administration Duty role,which is entitled to manage application key flexfields (the entitlement is ManageApplication Key Flexfield). This entitlement provides the access necessary toperform the Manage Segment Security task in General Ledger.

Manage Role Templates

Data role templates automatically create or update data roles based ondimensions such as business unit. As an enterprise expands, data role templatestrigger replication of roles for added dimensions. For example, when creatinga new business unit, a data role template generates a new Accounts PayablesManager data role based on the Financials Common Module Template forBusiness Unit Security data role template.

In the security reference implementation, the IT Security Manager job rolehierarchy includes the Application Role Management Duty role, whichis entitled to manage data role templates (the entitlement is Manage RoleTemplate). This entitlement provides the access necessary to perform the ManageRole Templates task in APM.

Manage Data Security Policies

Data security grants provisioned to roles are data security policies. The securityreference implementation provides a comprehensive set of predefined datasecurity policies and predetermined data security policies based on data roletemplates.

Data security policies are available for review in Authorization Policy Manager(APM). Data security policies are implemented by grants stored in Oracle FusionData Security (FND_GRANTS).

Data security policies secure the database resources of an enterprise. Databaseresources are predefined applications data objects and should not be changed.However, for cases where custom database resources must be secured objects,the IT security manager is entitled to manage database resources and create newdata security policies.

Warning

Review but do not modify HCM data security policies in APM except as acustom implementation. Use the HCM Manage Data Role And Security Profilestask to generate the necessary data security policies and data roles.

In the security reference implementation, the IT Security Manager job rolehierarchy includes the Application Role Management Duty role, which isentitled to manage data security policies (the entitlement is Manage DataSecurity Policy). This entitlement provides the access necessary to perform theManage Data Security Policies task in APM.


Data Security in the Security Reference Implementation: Explained

The reference implementation contains a set of data security policies that canbe inspected and confirmed to be suitable or a basis for further implementationusing the Authorization Policy Manager (APM).

The security implementation of an enterprise is likely a subset of the referenceimplementation, with the enterprise specifics of duty roles, data security policies,and HCM security profiles provided by the enterprise.

The business objects registered as secure in the reference implementation aredatabase tables and views.

Granting or revoking object entitlement to a particular user or group of users onan object instance or set of instances extends the base Oracle Fusion Applicationssecurity reference implementation without requiring customization of theapplications that access the data.

Data Security Policies in the Security Reference Implementation

The data security policies in the reference implementation entitle the grantee (arole) to access instance sets of data based on SQL predicates in a WHERE clause.

Tip

When extending the reference implementation with additional data securitypolicies, identify instance sets of data representing the business objects thatneed to be secured, rather than specific instances or all instances of the businessobjects.

Predefined data security policies are stored in the data security policy store,managed in the Authorization Policy Manager (APM), and described in theOracle Fusion Applications Security Reference Manual for each offering. A datasecurity policy for a duty role describes an entitlement granted to any job rolethat includes that duty role.

Warning


The reference implementation only enforces a portion of the data securitypolicies in business intelligence that is considered most critical to riskmanagement without negatively affecting performance. For performance reasonsit is not practical to secure every level in every dimension. Your enterprisemay have a different risk tolerance than assumed by the security referenceimplementation.


HCM Security Profiles in the Security Reference Implementation

The security reference implementation includes some predefined HCM securityprofiles for initial usability. For example, a predefined HCM security profileallows line managers to see the people that report to them.

The IT security manager uses HCM security profiles to define the sets of HCMdata that can be accessed by the roles that are provisioned to users

Data Roles

The security reference implementation includes no predefined data roles toensure a fully secured initial Oracle Fusion Applications environment.

The security reference implementation includes data role templates that youcan use to generate a set of data roles with entitlement to perform predefinedbusiness functions within data dimensions such as business unit. Oracle FusionPayables invoicing and expense management are examples of predefinedbusiness functions. Accounts Payable Manager - US is a data role you mightgenerate from a predefined data role template for payables invoicing if you setup a business unit called US.

HCM provides a mechanism for generating HCM related data roles.

Securing Data Access: Points to Consider

Oracle Fusion Applications supports securing data through role-based accesscontrol (RBAC) by the following methods.

Method of securing data Reason Example

Data roles apply explicit datasecurity policies on job andabstract roles

Appropriate for job and abstractroles that should only access asubset of data, as defined by thedata role template that generatesthe data role or by HCM securityprofiles.

Accounts Payable Manager- US data role to provide anaccounts payable manager in theUS business unit with access toinvoices in the US business unit.

Data security policies Define data access for applicationroles and provide inheriting joband abstract roles with implicitdata security

Projects

If a user has access to the same function through different roles that accessdifferent data sets, then the user has access to a union of those data sets.

When a runtime session is created, Oracle Platform Security Services (OPSS)propagates only the necessary user to role mapping based on Oracle Fusion DataSecurity grants. A grant can specify entitlement to the following.

• Specific rows of data (data object) identified by primary key


• Groups of data (instance set) based on a predicate that names a particularparameter

• Data objects or instance sets based on runtime user session variables

Data is either identified by the primary key value of the row in the table wherethe data is stored. Or data is identified by a rule (SQL predicate) applied to theWHERE clause of a query against the table where the data is stored.

Grants

Oracle Fusion Data Security can be used to restrict the following.

• Rows that are returned by a given query based on the intended businessoperation

• Actions that are available for a given row

Grants control which data a user can access.

Note

Attribute level security using grants requires a data security policy to secure theattribute and the entitlement check enforces that policy.

A grant logically joins a user or role and an entitlement with a static orparameterized object instance set. For example, REGION='WEST' is a static objectinstance set and REGION=&GRANT_ALIAS.PARAMETER1 is a parameterized objectinstance set. In the context of a specific object instance, grants specify theallowable actions on the set of accessible object instances. In the database,grants are stored in FND_GRANTS and object instance sets are stored inFND_OBJECT_INSTANCE_SETS. Object access can be tested using the privilegecheck application programming interface (API).

Securing a Business Object

A business object is a logical entity that is typically implemented as a table orview, and corresponds to a physical database resource. The data security policiesof the security reference implementation secure predefined database resources.Use the Manage Data Security Policies task to define and register other databaseresources.

Data security policies identify sets of data on the registered business object andthe actions that may be performed on the business object by a role The grant canbe made by data instance, instance set or at a global level..

Note

Use parameterized object instance sets whenever feasible to reduce the numberof predicates the database parses and the number of administrative interventionrequired as static object instances sets become obsolete. In HCM, security profilesgenerate the instance sets.



Database Resources and Data Security Policies: How They Work Together

A data security policy applies a condition and allowable actions to a databaseresource for a role. When that role is provisioned to a user, the user has accessto data defined by the policy. In the case of the predefined security referenceimplementation, this role is always a duty role. Data roles generated to inheritthe job role based on data role templates limit access to database resources in aparticular dimension, such as the US business unit.

The database resource defines and instance of a data object. The data object is atable, view, or flexfield.

The following figure shows the database resource definition as the means bywhich a data security policy secures a data object. The database resource namesthe data object. The data security policy grants to a role access to that databaseresource based on the policy's action and condition.

Database Resources

A database resource specifies access to a table, view, or flexfield that is securedby a data security policy.

• Name providing a means of identifying the database resource

• Data object to which the database resource points



Data security policies consist of actions and conditions for accessing all, some, ora single row of a database resource.

• Condition identifying the instance set of values in the data object

• Action specifying the type of access allowed on the available values

Note

If the data security policy needs to be less restrictive than any available databaseresource for a data object, define a new data security policy.

Actions

Actions correspond to privileges that entitle kinds of access to objects, such asview, edit, or delete. The actions allowed by a data security policy include all or asubset of the actions that exist for the database resource.

Conditions

A condition is either a SQL predicate or an XML filter. A condition expressesthe values in the data object by a search operator or a relationship in a treehierarchy. A SQL predicate, unlike an XML filter, is entered in a text field in thedata security user interface pages and supports more complex filtering than anXML filter, such as nesting of conditions or sub queries. An XML filter, unlike aSQL predicate, is assembled from choices in the UI pages as an AND statement.

Tip

An XML filter can be effective in downstream processes such as businessintelligence metrics. A SQL predicate cannot be used in downstream metrics.

Manage Role Templates

Data Role Templates: Explained

You use data role templates to generate data roles. You generate such data roles,and create and maintain data role templates in the Authorization Policy Manager(APM).

Note

HCM data roles are generated using the Manage Data Roles and Security Profilestask, which uses HCM security profiles, not data role templates, to define thedata security condition.

The following attributes define a data role template.

• Template name


• Template description

• Template group ID

• Base roles

• Data dimension

• Data role naming rule

• Data security policies

The data role template specifies which base roles to combine with whichdimension values for a set of data security policies. The base roles are the parentjob or abstract roles of the data roles.

Note

Abstract, job, and data roles are enterprise roles in Oracle Fusion Applications.Oracle Fusion Middleware products such as Oracle Identity Manager (OIM)and Authorization Policy Manager (APM) refer to enterprise roles as externalroles. Duty roles are implemented as application roles in APM and scoped toindividual Oracle Fusion Applications.

The dimension expresses stripes of data, such as territorial or geographicinformation you use to partition enterprise data. For example, business unitsare a type of dimension, and the values picked up for that dimension by thedata role template as it creates data roles are the business units defined for yourenterprise. The data role template constrains the generated data roles with grantsof entitlement to access specific data resources with particular actions. The datarole provides provisioned users with access to a dimensional subset of the datagranted by a data security policy.

An example of a dimension is a business unit. An example of a dimension valueis a specific business unit defined in your enterprise, such as US. An exampleof a data security policy is a grant to access a business object such as an invoicewith a view entitlement.

When you generate data roles, the template applies the values of the dimensionand participant data security policies to the group of base roles.

The template generates the data roles using a naming convention specifiedby the template's naming rule. The generated data roles are stored in theLightweight Directory Access Protocol (LDAP) store. Once a data role isgenerated, you provision it to users. A user provisioned with a data role isgranted permission to access the data defined by the dimension and datasecurity grant policies of the data role template.

For example, a data role template contains an Accounts Payable Specialistrole and an Accounts Payable Manager role as its base roles, and region as itsdimension, with the dimension values US and UK. The naming conventionis [base-role-name]:[DIMENSION-CODE-NAME]. This data role templategenerates four data roles.

• Accounts Payable Specialist - US (business unit)

• Accounts Payable Specialist - UK (business unit)

• Accounts Payable Manager - US (business unit)


• Accounts Payable Manager - UK (business unit)

Making Changes To Data Role Templates

If you add a base role to an existing data role template, you can generate anew set of data roles. If the naming rule is unchanged, existing data roles areoverwritten.

If you remove a base role from a data role template and regenerate data roles, aresulting invalid role list gives you the option to delete or disable the data rolesthat would be changed by that removal.

Making Changes to Dimension Values

If you add a dimension value to your enterprise that is used by a data roletemplate, you must regenerate roles from that data role template to create adata role for the new dimension. For example if you add a business unit to yourenterprise, you must regenerate data roles from the data role templates thatinclude business unit as a dimension.

If you add or remove a dimension value from your enterprise that is used togenerate data roles, regenerating the set of data roles adds or removes the dataroles for those dimension values. If your enterprise has scheduled regenerationas an Oracle Enterprise Scheduler Services process, the changes are madeautomatically.

For information on working with data role templates, see the Oracle FusionMiddleware Administrator's Guide for Authorization Policy Manager.

Manage Data Role and Security Profiles

HCM Data Roles: Explained

HCM data roles, like all Oracle Fusion Applications data roles, define datasecurity policies: they enable users to perform a set of tasks, using identifiedmenus, menu items, and pages in application user interfaces, on a specified set ofdata within those user interfaces. Because data roles are specific to the enterprise,no predefined HCM data roles exist.

How HCM Data Roles Differ from Other Data Roles

HCM data roles differ from other data roles in the following ways:

• You create and maintain HCM data roles outside Oracle IdentityManagement (OIM) and the Oracle Fusion Middleware AuthorizationPolicy Manager (APM), and they are not based on data role templates.

Although HCM data roles are visible in the Oracle Fusion MiddlewareAPM, they must not be maintained there.


• A single HCM data role can enable access to data of multiple types.

You identify the data that users can access in HCM security profiles. Youcan create security profiles for the person, organization, position, country,legislative data group (LDG), document type, payroll, payroll flow, andworkforce business process objects.

Selecting the Job Role

Each HCM data role is associated with a single job role, which you select fromthe list of enterprise roles. The HCM securing objects that the selected role needsto access are identified automatically, and the appropriate types of securityprofile are displayed. For example, if you select the job role human resourceanalyst, users with that job role need to access managed person, public person,organization, position, LDG, and document type data; therefore, security profilesfor those object types must be included in the HCM data role. The securityprofile types that appear in the HCM data role vary according to the datarequirements of the selected job role.

If you select a job role that requires no access to HCM data secured by securityprofiles, you cannot create an HCM data role.

Note

If you create custom job roles in OIM, you must add them to a locally definedrole category that ends with "Job Roles"; otherwise, they do not appear in the listof job roles when you create an HCM data role. Do not add custom job roles tothe predefined role category HCM - Job Roles.

Creating or Selecting the Security Profiles

You can either create new security profiles or use existing security profiles. Foreach object type, you can include only one security profile in an HCM data role.

Users with Multiple HCM Data Roles

When users have multiple HCM data roles, the data security policies arisingfrom each role remain separate. For example, being able to promote or terminateworkers in the purchasing department in one HCM data role and view contactdetails of all workers in the sales department in another HCM data role does notenable a user to promote or terminate workers in the sales department.

Components of the HCM Data Role

The following figure summarizes how the components of the HCM data rolecontribute to Oracle Fusion Data Security for the data role. Oracle Fusion DataSecurity comprises the data security policies for data roles that are generatedautomatically when data roles are created.

The job role that you select in the HCM data role inherits multiple duty roles.Each duty role has one or more function privileges and related data privileges,from which the relevant HCM objects are identified. The specific instances ofthe objects required by this HCM data role are identified in security profiles andstored in a data instance set. Data security policy data is created automatically inOracle Fusion Data Security when you create the data role.


For example, the human resource specialist job role inherits the employee hireand worker promotion duty roles, among many others. The inherited duty rolesprovide both function privileges, such as Hire Employee, Rehire Employee,and Promote Workers, and data privileges to HCM objects, such as personand assignment. The specific instances of those objects required by this HCMdata role, such as people with assignments in a specified legal employer anddepartment, are identified in security profiles.

HCM Security Profiles: Explained

A security profile defines the criteria that identify instances of a human capitalmanagement (HCM) object. For example, a person security profile defines thecriteria that identify one or more person records, and a position security profiledefines the criteria that identify one or more positions. When you include asecurity profile in an HCM data role and provision the data role to a user, thatuser can access the data instances identified in the security profile. The type ofaccess available to the user (for example whether the user can edit or simplyview the data) depends on the job role identified in the HCM data role.

HCM Object Types

You can create security profiles for the following HCM object types:

• Person

• Managed person

• Public person

• Organization


• Position

• Legislative data group (LDG)

• Country

• Document type

• Payroll

• Payroll flow

• Workforce business process

All security profile definitions for these HCM objects are eventually visiblein the Oracle Fusion Middleware Authorization Policy Manager (APM).The name of the security profile's data instance set in the Oracle FusionMiddleware APM is derived from the name of the security profile and therelevant object type. For example, if the security profile name is ManagerHierarchy, then the data instance set for the object PER_ALL_PEOPLE_F isHCM:PER:PER_ALL_PEOPLE_F:Manager Hierarchy.

You must use the Oracle Fusion Human Capital Management interfaces, whichare designed for ease of use and access, to create and maintain security profiles;do not use the Oracle Fusion Middleware APM to maintain security profiles forthese HCM objects.

Security Criteria in HCM Security Profiles

In any HCM security profile, you specify the criteria that identify data instancesof the relevant type. For example, in an organization security profile, you canidentify organizations by organization hierarchy, by organization classification,or by listing organizations to include in or exclude from the security profile.All of the criteria in an HCM security profile apply when the data instanceset is defined; for example, if you identify organizations by both organizationhierarchy and organization classification, then both sets of criteria apply, andonly those organizations that satisfy all criteria belong to the data instance set.

Predefined HCM Security Profiles

The following HCM security profiles are predefined:

Security Profile Name HCM Security Profile Type Description

View All People Person Identifies all person records in theenterprise

View Own Record Person Identifies the signed-on user'sown person record and the personrecords of that user's contacts

View Manager Hierarchy Person Identifies the signed-on user's linemanager hierarchy

View All Workers Person Identifies the person recordsof all people who have a workrelationship in the enterprise

View All Organizations Organization Identifies all organizations in theenterprise

View All Positions Position Identifies all positions in theenterprise

View All Legislative Data Groups LDG Identifies all LDGs in theenterprise


View All Countries Country Identifies all countries in theFND_TERRITORIES table

View All Document Types Document Type Identifies all document types inthe enterprise

View All Payrolls Payroll Identifies all payrolls in theenterprise

View All Flows Payroll Flow Identifies all payroll flows in theenterprise

View All Workforce BusinessProcesses

Workforce Business Process Identifies all registered workforcebusiness processes in theenterprise

You can include the predefined security profiles in any HCM data role, but youcannot edit them. Note also that the View all option is disabled in any securityprofile that you create; this restriction exists because predefined security profilesexist for this requirement.

Creating Security Profiles

You can create security profiles either individually or as part of the processof creating an HCM data role. If you have standard requirements, it may bemore efficient to create the security profiles individually and include them inappropriate HCM data roles.

Reusability and Inheritance of Security Profiles

Regardless of how you create them, all security profiles are reusable; they donot belong to particular HCM data roles, and you can include them in any HCMdata role for which they define an appropriate data instance set.

You can include security profiles in other security profiles. For example, you caninclude an organization security profile:

• In a person security profile, to secure person records by department,business unit, or legal employer

• In a position security profile, to secure positions by department orbusiness unit

Therefore, one security profile can inherit the data instance set defined byanother.

Assigning Security Profiles to Abstract Roles: Explained

Abstract roles define a worker's role in the enterprise independently of the jobthat the worker is hired to do.

These abstract roles are predefined in Oracle Fusion Human CapitalManagement:

• Line manager

• Employee

• Contingent worker

Enabling Data Access for Abstract Roles

Typically, you create role mappings during implementation to provision abstractroles automatically to eligible workers. Although users with these roles may be


able to sign in to Oracle Fusion Applications and navigate to tasks of interest,they have no automatic access to data. For example, employees can navigateto the Person Gallery but cannot view portraits or see lists of person names inproduct interfaces, and line managers can navigate to the Manager ResourcesDashboard but can see no data for their organizations. To enable users withabstract roles to access relevant HCM data, you must assign security profiles tothose abstract roles.

Predefined Security Profiles to Assign to Abstract Roles

To enable users with abstract roles to access relevant data, you assign thefollowing predefined security profiles directly to the employee, contingentworker, and line manager abstract roles.

Security Profile Type Employee Contingent Worker Line Manager

Person View Own Record View Own Record View Manager Hierarchy

Public person View All Workers View All Workers View All Workers

Organization View All Organizations View All Organizations View All Organizations

Position View All Positions View All Positions View All Positions

Legislative data group View All Legislative DataGroups

View All Legislative DataGroups

View All Legislative DataGroups

Country View All Countries View All Countries View All Countries

Document type View All DocumentTypes

View All DocumentTypes

View All DocumentTypes

Payroll Flow Not applicable Not applicable View All Flows

Workforce BusinessProcess

Not applicable Not applicable View All WorkforceBusiness Processes

After implementation, you may want to change aspects of this data access. Forexample, you may want to create your own security profiles and assign thosedirectly to abstract roles; however, you must remember that such changes applyto all users who have the abstract role.

HCM Data Roles

Users who have abstract roles are likely to gain additional data access by meansof HCM data roles that you define for their job roles. For example, you maycreate an HCM data role for human resource specialists to enable them to accessthe person records of all workers in a legal employer. Such data access is inaddition to any data access provided by abstract roles.

Assigning Security Profiles to Abstract Roles: Worked Example

This example shows how to assign predefined security profiles to the employee,contingent worker, and line manager abstract roles.

Searching for the Employee Abstract Role

1. On the All Tasks tab of the Overview page of the Setup and Maintenancework area, search for the task Manage Data Role and Security Profiles.

2. In the Search Results region, click Go to Task.


3. On the Manage Data Roles and Security Profiles page, enter the abstract-role name Employee in the Role field. Click Search.

4. In the Search Results region, highlight the entry for the predefinedEmployee role and click Assign.

Assigning Security Profiles to the Employee Abstract Role

1. On the Assign Data Role: Security Criteria page, select the security-profilevalues shown in the following table. These are the security profiles thatare typically assigned to the employee role. You may see a subset of thesesecurity profiles, depending on the combination of product offerings thatyou are implementing.

Field Value

Organization Security Profile View All Organizations

Position Security Profile View All Positions

Country Security Profile View All Countries

LDG Security Profile View All Legislative Data Groups

Person Security Profile (Person

section)

View Own Record

Person Security Profile (Public Person

section)

View All Workers

Document Type Security Profile View All Document Types

2. Click Review.

3. On the Assign Data Role: Review page, click Submit.

4. On the Manage Data Roles and Security Profiles page, search again for thepredefined Employee role.

5. In the Search Results region, confirm that a green check mark appearsin the Security Profiles column for the Employee role. The check markconfirms that security profiles are assigned to the role.

Repeat the steps in Searching for the Employee Abstract Role andAssigning Security Profiles to the Employee Abstract Role for thepredefined Contingent Worker role.

Searching for the Line Manager Abstract Role

1. On the Manage Data Roles and Security Profiles page, enter the abstract-role name Line Manager in the Role field. Click Search.

2. In the Search Results region, highlight the entry for the predefined LineManager role and click Assign.

Assigning Security Profiles to the Line Manager Abstract Role

1. On the Assign Data Role: Security Criteria page, select the security-profilevalues shown in the following table. These are the security profiles thatare typically assigned to the line manager role. You may see a subset ofthese security profiles, depending on the combination of product offeringsthat you are implementing.


Field Value

Organization Security Profile View All Organizations

Position Security Profile View All Positions

LDG Security Profile View All Legislative Data Groups

Person Security Profile (Person

section)

View Manager Hierarchy

Person Security Profile (Public Person

section)

View All Workers

Document Type Security Profile View All Document Types

Payroll Flow View All Flows

Workforce Business Process View All Workforce Business Processes

2. Click Review.

3. On the Assign Data Role: Review page, click Submit

4. On the Manage Data Roles and Security Profiles page, search again for thepredefined Line Manager role.

5. In the search results, confirm that a green check mark appears in theSecurity Profiles column for the Line Manager role. The check markconfirms that security profiles are assigned to the role.

Define Automated Governance, Risk, and Performance Controls

Segregation of Duties: Explained

Segregation of duties (SOD) separates activities such as approving, recording,processing, and reconciling results so an enterprise can more easily prevent ordetect unintentional errors and willful fraud. SOD policies, called access controlpolicies in Application Access Controls Governor (AACG), exert both preventiveand detective effects.

SOD policies constrain duties across roles so that unethical, illegal, or damagingactivities are less likely. SOD policies express constraints among roles. Duty roledefinitions respect segregation of duties policies.

Application Access Controls Governor

You manage, remediate, and enforce access controls to ensure effective SODusing the Application Access Controls Governor (AACG) product in the OracleEnterprise Governance, Risk and Compliance (GRC) suite.

AACG applies the SOD policies of the Oracle Fusion Applications securityreference implementation using the AACG Oracle Fusion Adapter.

AACG is integrated with Oracle Identity Management (OIM) in Oracle FusionApplications to prevent SOD control violations before they occur by ensuring


SOD compliant user access provisioning. SOD constraints respect provisioningworkflows. For example, when provisioning a Payables role to a user, the SODpolicy that ensures no user is entitled to create both an invoice and a paymentprevents the conflicting roles from being provisioned. AACG validates therequest to provision a user with roles against SOD policies and provides aremediating response such as approval or rejections if a violation is raised.

Use AACG to for the following.

• Define SOD controls at any level of access such as in the definition of anentitlement or role.

• Simulate what-if SOD scenarios to understand the effect of proposed SODcontrol changes.

• Use the library of built-in SOD controls provided as a security guideline.

Managing Segregation of Duties

SOD policies express incompatible entitlement or incompatible access points intoan application. In GRC, an access point is the lowest level access for a particularapplication. In GRC, entitlement is a grouping of access points. As a securityguideline, group the lowest level access points or define the SOD policy at theaccess level causing the least amount of change. Business activities are enabledat access points. In Oracle Fusion Applications, the hierarchy of access points indescending levels is users, roles, and entitlement.

Note

AACG entitlements are logical groupings of security objects that representOracle Fusion Application access points such as roles or entitlement.

Note

In AACG, segregation of duties policies are called access controls.

Oracle Fusion Applications does not predefine business logic for dealing withSOD conflicts. Oracle Fusion Applications does define a set of states where rolerequests are suspended pending resolution of SOD violations the role requestintroduces. In most cases, Oracle Fusion Applications invokes OIM to handlerole requests. Enterprises define SOD resolution rules when defining SOD policy.

Remediating Segregation of Duties Policy Violations

The risk tolerance of your enterprise determines what duties must be segregatedand how to address violations.

AACG assists in remediation of violations with a guided simulation thatidentifies corrective action. You determine the exact effects of role andentitlement changes prior to putting them into production, and adjust controls asneeded.


For information on managing segregation of duties, see the Oracle ApplicationAccess Controls Governor Implementation Guide and Oracle Application AccessControls Governor User's Guide.

Segregation of Duties in the Security Reference Implementation: Explained

Segregation of duties (SOD) is a special case of function security enforcement.A segregation of duties conflict occurs when a single user is provisioned with arole or role hierarchy that authorizes transactions or operations resulting in thepossibility of intentional or inadvertent fraud.

The predefined SOD policies result in duty separation with no inherentviolations. For example, an SOD policy prevents a user from entitlement tocreate both payables invoices and payables payments.

However, the most common duties associated with some job and abstractroles could conflict with the predefined segregation of duties. A predefinedrole hierarchy or job or abstract role may include such common duties thatare incompatible according to a segregation of duties policy. For example, thepredefined Accounts Payable Supervisor job role includes the incompatibleduties: Payables Invoice Creation Duty and Payables Payment Creation Duty.

Every single predefined duty role is free from an inherent segregation of dutiesviolation. For example, no duty role violates the SOD policy that prevents a userfrom entitlement to both create payables invoices and payables payments.

Jobs in the reference implementation may contain violations against theimplemented policies and require intervention depending on your risk tolerance,even if you define no additional jobs or SOD policies.

Provisioning enforces segregation of duties policies. For example, provisioninga role to a user that inherits a duty role with entitlement to create payablesinvoices enforces the segregation of duties policy applied to that duty roleand ensures the user is not also entitled to create a payables payment. Whena role inherits several duty rules that together introduce a conflict, the role isprovisioned with a violation being raised in the Application Access ControlsGovernor (AACG). If two roles are provisioned to a user and introduce asegregation of duties violation, the violation is raised in AACG.

Note

SOD policies are not enforced at the time of role definition.

Aspects of segregation of duties policies in the security reference implementationinvolve the following.

• Application Access Controls Governor (AACG)

• Conflicts defined in segregation of duties policies

• Violations of the conflicts defined in segregation of duties policies


Application Access Controls Governor (AACG)

AACG is a component of the Oracle Enterprise Governance, Risk andCompliance (GRC) suite of products where segregation of duties policies aredefined.

• Define SOD controls at any level of access such as in the definition of anentitlement or role.

• Simulate what-if SOD scenarios to understand the effect of proposed SODcontrol changes.

• Use the library of built-in SOD controls provided as a security guideline.

Your risk tolerance determines how many duties to segregate. The greaterthe segregation, the greater the cost to the enterprise in complexity atimplementation and during maintenance. Balance the cost of segregation withthe reduction of risk based on your business needs.

Conflicts

An intra-role conflict occurs when a segregation of duties policy expressesconstraints within the construct of a single role (entitlement and duties) thatcreates violations.

Tip


Violations

A segregation of duties violation occurs when a policy is defined that allows asegregation of duties conflict to occur.

Notifications report conflicts to the requester of the transaction that raised theviolation. Oracle Identity Management (OIM) shows the status of role requestsindicating if a segregation of duties violation has occurred.

For information on configuring audit policies, see the Oracle Fusion ApplicationsAdministrator's Guide.

For more information on managing segregation of duties, see the OracleApplication Access Controls Governor Implementation Guide and OracleApplication Access Controls Governor User's Guide.


Defining Segregation of Duties Policies: Points To Consider

Segregation of duties (SOD) policies express incompatibilities enforced to controlaccess in defined contexts.

In Oracle Fusion Applications, SOD policies protect against the followingincompatibilities.

• Privilege X is incompatible with privilege Y

• Role A is incompatible with role B

• Any privileges in role A are incompatible with any privileges in role B.

• Privilege X is incompatible with any privileges in role B.

The following examples of SOD policies illustrate incompatible entitlement.

• No user should have access to Bank Account Management and SupplierPayments duties.

• No user should have access to Update Supplier Bank Account andApprove Supplier Invoice entitlement.

Data Contexts

You can extend SOD policies to control access to specific data contexts.

For example, no single individual must be able to source a supplier in a businessunit and approve a supplier invoice in the same business unit.

Exclusion and Inclusion Conditions

SOD policies may include exclusion conditions to narrow the SOD scope andreduce false positive violations, or inclusion conditions to broaden the scope.

Conditions apply to access points globally, to policies, or to access paths definedby policies. Access path conditions can exclude a user from a role, an OracleFusion Applications entitlement from a role, or a permission from an OracleFusion Applications entitlement.

The following global exclusion conditions are predefine in Oracle FusionApplications and available when creating SOD policies.

• User Status

• User Name

• Enterprise Role

• Action


• Business Unit

• Within Same Business Unit

Enforcement

Oracle Fusion Applications enforces SOD policies under the followingcircumstances.

• When granting entitlement to a role

• When provisioning a role to a user

For information on managing segregation of duties, see Oracle ApplicationAccess Controls Governor Implementation Guide and Oracle Application AccessControls Governor User's Guide.

Note

SOD policies are not enforced at the time of role definition.

Aspects of segregation of duties policies in the security reference implementationinvolve the following.

• Application Access Controls Governor (AACG)

• Conflicts defined in segregation of duties policies

• Violations of the conflicts defined in segregation of duties policies

A single SOD policy can include entitlement from multiple instances of a singleenterprise resource planning environment. For example, one SOD policy isenforced in implementation, test, and production instances of Oracle FusionApplications.

Managing Segregation of Duties Risks and Violations: Critical Choices

You assess and balance the cost of duty segregation against reduction of riskbased on the requirements of your enterprise.

The types of people who resolve SOD conflicts include the following.

• Administrator of an external program such as the ProcurementAdministrator for the supplier portal or the Partner Manager for the PRMProgram

• Senior executive spanning multiple organizations in an enterprise withopposing interests


• Risk management professional implementing an Oracle EnterpriseGovernance, Risk and Compliance (GRC) initiative

• Predefines a set of conditions and informs access provisioning staff toapprove requests and prove the exception based on certain conditions

• Allows defining rules to route SOD violations for approval

You view and respond to risks and violations in the Application Access ControlsGovernor (AACG).

You may wish to override an SOD violation. For example, the Accounts PayableSupervisor includes incompatible duties to create both invoices and payments.When you provision this job role to a user, you may waive the violation in theAACG. You may waive the violation for the currently provisioned user, for theSOD policy that raised the violation, or for the SOD policy within a particulardata set, such as a business unit.

The risk tolerance of your enterprise guides how you respond to conflicts. Forexample, a user may be provisioned with both the role of Order Manager andShipping Agent. The Order Manger role entitles the user to enter orders, whichcould result in exploitation when filling shipping quotas. You can remove theentitlement to enter orders that the Order Manger job role inherits from theOrchestration Order Scheduling Duty role. Or you could segregate the shippingand order entry duties by defining an SOD policy that allows a user to haveeither job role but not both.

False Positives

False positives can be SOD policy violations that are not actually violations, orare violations within your risk tolerance and therefore do not require correctiveaction.

You can reduce false positives by the following methods.

• Define exclusion conditions that can be applied to individual or groups ofpolicies.

• Define logically complex SOD policies that enforce more exactingspecifications.

• Determine whether conflicts should be prevented, monitored, or subjectedto approval during provisioning.

Path Level Detection

Conflict analysis detects a user's multiple paths to one or more conflicting accesspoints.

For example, a user may be able to reach a single access point through oneor more roles, or by one entitlement leading to another through submenusto a function that represents a risk. The resulting conflict path shows if theconflict is generated by inappropriate role provisioning or configuration ofapplications. The audit shows the paths from any number of users to anynumber of access points involved in conflicts, which lets you visualize the rootcause and remediate effectively.


AACG assigns one or more users to review all paths involved in a given conflictso that the entire conflict can be addressed in a coherent way.

Waiving or Accepting Violations

AACG lets you accept or waive a violation. Your reasons may include that youaccept the risk or will define compensating controls.

A waiver may apply to the current user, constraint, or constraint within adimension such as the business unit.

Resolving Conflicts

The risk tolerance of the enterprise determines whether a segregation of dutiesconflict must be removed from the security reference implementation.

The following approaches resolve conflicts.

• Change the segregation of duties policy.

• Ensure a job role does not contain incompatible duties.

• Define data security policies that restrict authorized access byincompatible duties.

Changing a segregation of duties policy may not be possible in most cases. Forexample, a policy that segregates creation of payables invoice from makingpayables payments should be preserved, even if the Accounts PayablesManager job role includes a duty role for each activity. To prevent an accountspayables manager from being authorized to perform both duties, or from beingauthorized to make payables payments to self and direct reports, the AccountsPayables Manager job role must be changed. The security implementation can bechanged to include two job roles that segregate the incompatible duties. Addeddata security policy grants can restrict the access to at risk data.


Role Provisioning and Segregation of Duties: How They Work Together

Segregation of duties (SOD) checks occur when roles are assigned to users. Thechecks are based on Oracle Application Access Controls Governor (AACG)policies in Oracle Enterprise Governance, Risk and Compliance (GRC). TheOracle Identity Management (OIM) integration includes predefined routing rulesfor remediation in the Manage IT Security business process.

External users such as suppliers or partners need to be provisioned with rolesto facilitate access to parent company interfaces and data. The process by whichsuch provisioning requests are approved in Oracle Fusion Applications helpsexplain the request flows and possible outcomes.


Note

In Oracle Identity Management (OIM), external users means users who are notspecific to applications, such as enterprise roles or the absence of entitlement toaccess an application.

The figure shows the role provisioning request flow. OIM uses AACG to checksegregation of duties violations.

Tables

A supplier or partner requests admission to a program using an implementationof the Supplier Portal Submission. The submission is captured in one or both ofthe following tables in advance of approving or rejecting the supplier or partner.

• Oracle Fusion Trading Community Model

• Interface Staging

Oracle Fusion Applications collects the employee names for the supplier orpartner company at the time the company submits its request to join the programso that all employees accessing Oracle Fusion Applications on behalf of thesupplier or partner are provisioned.

AACG in the Oracle Enterprise Governance, Risk and Compliance (GRC) suiteis certified to synchronize with the policy and identity stores for all pillars orpartitions of Oracle Fusion Applications and integrated with the Oracle Fusion


Applications security approach to roll up entitlements (by means of duty roles)to the roles that are provisioned to internal users. SOD policies can be definedand enforced at any level of authorization. For external users, SOD policies useattribute information stored in the Trading Community Model tables.

OIM and the SPML Client

Enterprise business logic may qualify the requester and initiate a roleprovisioning request by invoking the Services Provisioning Markup Language(SPML) client module, as may occur during onboarding of internal users withHuman Capital Management (HCM), in which case the SPML client submits anasynchronous SPML call to OIM. Or OIM handles the role request by presentingroles for selection based on associated policies.

OIM recognizes the role provisioning request and initiates a call to AACG.

OIM apprises the SPML client of the current state of the role provisioningrequest as SOD_CHECK_IN_PROGRESS.

OIM stores the SOD check result as part of OIM audit data.

OIM apprises SPML client of the current state of the SPML request. Theprovisioning is either still in progress with segregation of duties being checked,or conflicts were found. If conflicts exist, AACG rejects the request and notifiesthe application.

Status Conflicts Current State

SOD_CHECK_IN_PROGRESS Unknown Request sent to AACG andwaiting for response

SOD_REMEDIATION_IN_PROGRESSConflict found AACG detected violations andremediation is in progress

SOD_CHECK_APPROVED No conflict found No SOD violations found

SOD_CHECK_REJECTED Conflict found AACG detected violations thatcannot be remediated

SOD_REMEDIATION_APPROVED Conflict found AACG detected violations that areapproved

SOD_REMEDIATION_REJECTED Conflict found AACG detected violations that arerejected by approver

In the absence of an SOD exception, OIM provisions all relevant users.

Note

When a partner user is provisioned, all employees of the partner enterprise areprovisioned. SOD checks occur when an external user requests to join a program,because SOD policies operate across Oracle Fusion Applications, not at theindividual level. Supplier or partner company user requests are not approved ifthere is an SOD conflict against the supplier company.

OIM provides AACG with the details of SOD exception approval workflow.AACG audits the outcome for use in future detective controls and auditprocesses.


Oracle Application Access Controls Governor

AACG may respond with the following.

• Roles may be provisioned to the external user or its employees because noSOD conflict is found

• SOD conflict is found and request is denied because the relevant SODpolicy is to be strictly enforced and no exception approval should beallowed

• SOD conflict is found and the exception to the policy is allowed, so therequest goes through additional processing, such as an approval process.

Supplier or Partner Relationship Management responds to an SOD exception byupdating Trading Community Model tables with the current state. An enterprisemay elect to implement a landing pad that offers external users a means ofaddressing the SOD problem by providing more information or withdrawing therequest.

SOD violation checking occurs during role implementation and provisioning,and can be turned on or off if AACG is provisioned and enabled as part of theOracle Fusion Applications deployment.

Segregation of Duties Exception Resolution or Approval Workflow

Depending upon status, OIM kicks off an auditable SOD exception resolutionworkflow. Resolution can be conditional based on approval or requirements suchas contracts being met.

If one of the paths for exception resolution is to get an approval, then the SODexception resolution drives the approval using AMX. Standard AMX rules,not business rules, resolve the approval for the SOD exception, including thefollowing.

• Organizational hierarchies

• Multiple mandatory and optional approvers

• Rerouting and approval delegation

The approver resolution uses AMX Rules Designer to access various userattributes and organizational hierarchies managed in Oracle Fusion Applicationsrepositories. This information is typically not available in OIM or the LDAPidentity store repository. Enterprises can define additional approval rules usingAMX Thin Client.

The SOD Exception Approver gets a notification through supported channelsthat a new request is awaiting approval. The approver signs in to the global SOAfederated worklist application that aggregates all pending worklist items forthe user from all Oracle Fusion applications and logical partitions or pillars ofapplications. The SOD exception approval tasks show up in the same list.

The SOD exception approval task shows the details of the SPML request andSOD Provisioning results in a page rendered by OIM. The approver may takeone of the following actions.


• Approve the request as it is

• Reject the request

If the approver approves the request, OIM sends anSOD_REMEDIATION_APPROVED status to the SPML client.

If the approver rejects the request, OIM sends anSOD_REMEDIATION_REJECTED status to the SPML client. The provisioningrequest is considered completed with a failure outcome and the external usersis notified. Oracle Fusion Applications updates the Trading Community Modeltables with the rejected status

Remediation Task Assignments

The SOD remediation tasks are assigned based on the role being requested.

1. If the role requested is Chief Financial Officer, the SOD remediation task isassigned to the IT Security Manager role.

2. If the SOD violation results from a policy where the SOD control tagis the Information Technology Management business process and thecontrol priority is 1, the SOD remediation task is assigned to ApplicationAdministrator role.

3. In all other scenarios, the SOD remediation task is assigned to theController role.

For more information about configuring audit policies, see the Oracle FusionApplications Administrator's Guide.


Define Currencies and Currency Rates 4-1

4Define Currencies and Currency Rates

Manage Currencies

Defining Currencies: Points to Consider

When creating or editing currencies, consider these points relevant to enteringthe currency code, date range, or symbol for the currency.

Currency Codes

You cannot change a currency code after you enable the currency, even if youlater disable that currency.

Date Ranges

Users can enter transactions denominated in the currency only for the dateswithin the specified range. If you do not enter a start date, then the currency isvalid immediately. If you do not enter an end date, then the currency is validindefinitely.

Symbols

Even if you enter a symbol for a currency, the symbol is not always displayedwhen an amount is displayed in this currency. Some applications use currencysymbols when displaying amounts. Others, like Oracle Fusion General Ledger,do not.

Euro Currency Derivation: Explained

Use the Derivation Type, Derivation Factor, and Derivation Effective Date fieldsto define the relationship between the official currency (Euro) of the European


Monetary Union (EMU) and the national currencies of EMU member states. Foreach EMU currency, you define its Euro-to-EMU fixed conversion rate and theeffective starting date.

Note

If you need to use a different currency code for Euro, you can disable thepredefined Euro currency and create a new one.

Derivation Type

The Euro currency derivation type is used only for the Euro, and the Euroderived derivation type identifies national currencies of EMU member states. Allother currencies do not have derivation types.

Derivation Factor

The derivation factor is the fixed conversion rate by which you multiply oneEuro to derive the equivalent EMU currency amount. The Euro currency itselfshould not have a derivation factor.

Derivation Effective Date

The derivation effective date is the date on which the relationship between theEMU currency and the Euro begins.

FAQs for Manage Currencies

When do I create or enable currencies?

Create currencies to use, for example for reporting purposes, if they are notalready provided. All currencies from the International Organization forStandardization (ISO) 4217 standard are provided.

Enable any currency other than USD for use in Oracle Fusion Applications,for example for displaying monetary amounts, assigning to ledgers, enteringtransactions, and recording balances. Only USD is enabled by default.

What's the difference between precision, extended precision, and minimum

accountable unit for a currency?

Precision is the number of digits to the right of the decimal point used in regularcurrency transactions. Extended precision is the number of digits to the rightof the decimal point used in calculations for this currency, and it must begreater than or equal to the standard precision. For example, USD would have2 for precision because amounts are transacted as such, for example $1.00. Forcalculations, for example adding USD amounts, you might want the application


to be more precise than two decimal digits, and would enter an extendedprecision accordingly.

Note

Some applications use extended precision. Others, such as Oracle Fusion GeneralLedger, do not.

Minimum accountable unit is the smallest denomination for the currency. Forexample, for USD that would be .01 for the cent. This unit does not necessarilycorrespond to the precision for all currencies.

What's a statistical unit currency type?

The statistical unit currency type is used only for the Statistical (STAT) currency.The Statistical currency is used to record statistics such as the number of itemsbought and sold. Statistical balances can be used directly in financial reports,allocation formulas, and other calculations.

Manage Conversion Rate Types

Creating Conversion Rate Types: Critical Choices

Maintain different conversion rates between currencies for the same periodwith the Oracle Fusion General Ledger conversion rate types functionality. Fourpredefined daily conversion rate types are seeded: Spot, Corporate, User, andFixed, allowing you to use different rate types for different business needs.During journal entry, the conversion rate is provided automatically by theGeneral Ledger based on the selected conversion rate type and currency, unlessthe rate type is user. For user rate types, you must enter the conversion rate.Define additional rate types as needed. Set your most frequently used rate typeas the default. Conversion rate types cannot be deleted.

Assign conversion rate types to automatically populate the associated rate foryour period average and period end rates for the ledger. For example, you canassign the predefined rate type Spot to populate your period average rates andthe predefined rate type Corporate to populate your period end rates. Periodaverage and period end rates are used in translation of account balances.

Conversion rate types are used to automatically assign a rate when you performthe following accounting functions:

• Convert foreign currency journal amounts to ledger currency equivalents

• Convert journal amounts from source ledgers to reporting currencies orsecondary ledgers

• Run Revaluation or Translation processes

In creating new conversion rates, decide whether to do the following:


• Enforce inverse relationships

• Select pivot currencies

• Select contra currencies

• Enable cross rates and allow cross rate overrides

• Maintain cross rate rules

Enforce Inverse Relationships

Check the Enforce Inverse Relationship check box to specify whether or not toenforce the automatic calculation of inverse conversion rates when defining dailyrates.

Action Results

Checked When you enter a daily rate to convert currency A tocurrency B, General Ledger automatically calculatesthe inverse rate, currency B to A, and enters it inthe adjacent column. If either rate is changed, theapplication automatically recalculates the other rate.

You can update the application calculated inverserate, but once you do, the related rate is updated.The check box enforces that the inverse relationshipis maintained but does not prevent you fromupdating the rates.

Unchecked General Ledger calculates the inverse rate but youcan change the rate and update the daily rates tablewithout the corresponding rate being updated.

Select Pivot Currencies

Select a pivot currency that is commonly used in your currency conversions.A pivot currency is the central currency that interacts with contra currencies.For example, you set up a daily rate between the US dollar (USD) and theEuro currency (EUR) and another between the USD and the Canadian dollar(CAD). USD is the pivot currency in creating a rate between EUR and CAD.EUR and CAD are the contra currencies. Select the pivot currency from the listof values which contains those currencies that are enabled, effective, and not astatistical (STAT) currency. The description of the pivot currency is populatedautomatically based on the currency definition.

If you want the application to create cross rates against a base currency, definethe base currency as the pivot currency. Selected pivot currencies can be changedin the Rate Types page.

Select Contra Currencies

Select currencies available on the list of values as contra currencies. The availablecurrencies are those currencies which are enabled, effective, not STAT currency,and not the pivot currency selected earlier. The description of the contra currency


is populated automatically based on the currency definition. Add or deletecontra currencies in the Contra Currencies region of the Rate Types page.

Enable Cross Rates and Allow Cross Rate Overrides

Check the Enable Cross Rates check box to calculate conversion rates basedon defined currency rate relationships. General Ledger calculates cross ratesbased on your defined cross rate rules. Associate your cross rate rules with aconversion rate type, pivot currency, and contra currencies. Cross rates facilitatethe creation of daily rates by automatically creating the rates between contracurrencies based on their relationship to a pivot currency. If the Enable CrossRates check box is changed to unchecked after entering contra currencies,the application stops calculating cross rates going forward for that particularrate type. All the earlier calculated cross rates for that rate type remain in thedatabase unless you manually delete them.

For example, if you have daily rates defined for the pivot currency, USD to thecontra currency, EUR, and USD to another contra currency, CAD, the applicationwill automatically create the rates between EUR to CAD and CAD to EUR. Thisprevents the need to manually define the EUR to CAD and CAD to EUR rates.

Check the Allow Cross Rates Override check box to permit your usersto override application generated cross rates. If you accept the default ofunchecked, the application generated cross rates cannot be overridden

Maintain Cross Rate Rules

Define or update your cross rate rules at any time by adding or removingcontra currency assignments. Add a contra currency to a cross rate rule and runthe Daily Rates Import and Calculation process to generate the new rates. Ifyour remove a cross rate rule or a contra currency from a rule, any cross ratesgenerated previously for that contra currency remain unless you manually deletethem. Changes to the rule are not retroactive and will not affect previously storedcross rates. The Cross Rate process generates as many rates as possible and skipscurrencies where one component of the set is missing.

Note

With a defined web service that extracts daily currency conversion ratesfrom external services, for example Reuters, currency conversion rates areautomatically updated for the daily rates and all cross currency relationships.

Using Rate Types: Examples

There are four seeded conversion rate types in Oracle Fusion applications:

• Spot

• Corporate

• User


• Fixed

Scenario

You are the general ledger accountant for InFusion America Inc. You are enteringa journal entry to capture three transactions that were transacted in threedifferent foreign currencies:

• Canadian dollar (CAD): A very stable currency

• Mexican Peso (MXP): A fluctuating currency

• Hong Kong dollar (HKD): An infrequently used currency

You enter two lines with accounts and amounts for each foreign currencytransaction. Based on your company procedures, you select the appropriate ratetype to populate the rate for Corporate and Spot rate types from your daily ratestable. You manually enter the current rate for the User rate type.

Currency Selected Rate Type Selected Reason

CAD Corporate Entered a periodic type oftransaction. Your company hasestablished a daily rate to use forthe entire month across divisionsfor all transactions in CAD. CADis a stable currency that onlyfluctuations slightly over themonth.

MXP Spot Entered a periodic type oftransaction. Your company entersdaily rates each day for MXPbecause this currency is unstableand fluctuates.

HKD User Entered a one time transaction.Your company does not maintaindaily rates in HKD.

Note

Your company does not currently use the Fixed rate type. From January 1, 1999,the conversion rate of the French franc (FRF) against the euro currency (EUR)was set at a fixed rate of 1 EUR to 6.55957 FRF. Your French operations werestarted in 2007, so you maintain all your French business records in the EUR.

FAQs for Manage Conversion Rate Types

What's the difference between spot, corporate, user, and fixed rate types?

Spot, corporate, user, and fixed conversion rate types differ based on thefluctuations of your entered foreign currency and your company procedures formaintaining daily rates.


Rate Type Usage

Spot For currencies with fluctuating conversion rates orwhen exact currency conversion is needed.

Corporate For establishment of a standard rate across yourorganization for a stable currency.

User For infrequent entries where your daily rates for theentered foreign currency are not set up.

Fixed For rates where the conversion is constant betweentwo currencies.

If you have infrequent foreign currency transactions, the user rate type cansimplify your currency maintenance while providing an accurate conversion rateon the date of the transaction.

Manage Daily Rates

Entering Daily Rates Manually: Worked Example

You are required to enter the daily rates for currency conversion from GreatBritain pounds sterling (GBP) to United States dollars (USD) each day for yourcompany InFusion America Inc.

Oracle Application Development Framework (ADF) Desktop Integration isan Excel add-in that must be loaded onto each client. Because ADF DesktopIntegration is an add-in to Microsoft Office products, you can use this featureonly if they have Microsoft Excel 2007 or above, Internet Explorer 7 or above,and Microsoft Windows 7, XP Professional SP2, or Vista. Users must downloadthe installation files from Navigator - Tools - Download Desktop IntegratorInstaller.

Entering Daily Rates

1. Navigate to the Period Close work area.

Use the Period Close work area to link to close processes and currencyprocess.

2. Click the Manage Currency Rates link.

Use the Currency Rates Manager page to create, edit, and review currencyrate types, daily rates, and historical rates.

3. Click the Daily Rates tab.

Use the Daily Rates tab to review and enter currency rates.

4. Click the Create in Spreadsheet button.

Use the Create Daily Rates spreadsheet to enter daily rates in a templatethat you can save and reuse.

5. Click in the From Currency field. Select the GBP - Pound Sterling list item.


6. Click in the To Currency field. Select the USD - US Dollar list item.

7. Click in the Conversion Rate field. Select the Spot list item

8. Click in the From Conversion field. Enter the desired information into theFrom Conversion field. Enter a valid value e.g. "8/1/2011".

9. Click in the To Conversion Date field. Enter the desired information intothe To Conversion Date field. Enter a valid value e.g. "8/1/2011".

10. Click in the Conversion Rate field. Enter the desired information into theConversion Rate field. Enter a valid value e.g. "1.33225".

11. Click the Submit button. Click the OK button twice.

12. Review the Record Status column to verify that all rows were loadedsuccessfully.

13. Save the template to use to enter daily rates frequently. You can save thespreadsheet to either a local drive or a shared network drive.

Updating Currency Rates: Worked Example

You are required to change today's daily rates that were already entered. Therates you are changing are for currency conversion from Great Britain poundssterling (GBP) to United States dollars (USD) for your company InFusionAmerica Inc.

Currency conversion rates were entered by an automatic load to the Daily Ratestable. They can also be entered through a spreadsheet.

Updating Currency Rates

1. Navigate to the Period Close work area.

Use the Period Close work area to link to close processes and currencyprocess.

2. Click the Manage Currency Rates link.

Use the Currency Rates Manager page to create, edit, and review currencyrate types, daily rates, and historical rates.

3. Click the Daily Rates tab.

Use the Daily Rates tab to review and enter currency rates.

4. Click the From Currency list. Select the GBP - Pound Sterling list item.

5. Click the To Currency list. Select the USD - US Dollar list item.

6. Enter the dates for the daily rates that you are changing. Enter today'sdate.

7. Click the Rate Type list. Select the Spot list item.

8. Click the Search button.

9. Click in the Rate field. Enter the new rate of 1.7 in the Rate field.

10. Click in the Inverse Rate field. Enter the new inverse rate of 0.58822 in theInverse Rate field.


11. Click the Save button.

Define Approval Management 5-1

5Define Approval Management

Approval Management: Highlights

Use approval management to determine the policies that apply to approvalworkflows for particular business objects such as expense reports. For example,you can specify levels of approval for expense reports over a particular amount,to reflect your own corporate policies. You also determine the groups of userswho act on these workflow tasks, for example, the chain of approvers forexpense reports.

Approval management is fully described in the Oracle Fusion MiddlewareModeling and Implementation Guide for Oracle Business Process Management.Though the concepts described there apply also to Oracle Fusion Applications,the only setup relevant to Oracle Fusion Applications involves approval groupsand task configuration. Customization of approval workflows themselves isdescribed in the Oracle Fusion Applications Extensibility Guide for Developers.

Overview

• Approval management is an extension of the human workflow services ofOracle SOA Suite. Refer to the Oracle Fusion Middleware Modeling andImplementation Guide for Oracle Business Process Management.

See: Introduction to Approval Management

See: Understanding Approval Management Concepts

Approval Groups and Task Configuration

• An approval group consists of a name and a predefined set of usersconfigured to act on a task in a certain pattern. Refer to the Oracle FusionMiddleware Modeling and Implementation Guide for Oracle BusinessProcess Management.

See: Administering Approval Groups

• Task configuration involves managing policies that control approvalflows. Refer to the Oracle Fusion Middleware Modeling andImplementation Guide for Oracle Business Process Management.


See: Using Task Configuration

• To configure a predefined approval policy, select the predefined rule setand click the Edit task icon button.

• To disable a predefined rule set, select the Ignore this participant checkbox for that rule set.

• To edit the rules within a predefined rule set, you can insert, update, ordelete from the seeded rules as needed while in edit mode.

• You can configure a specific rule to automatically approve withoutbeing sent to any approver. Modify the routing for that rule so that it issent to the initiator (which means the requestor is the approver), set theAuto Action Enabled option to True, and enter APPROVE in the AutoAction field.

Customization

• You can optionally customize predefined approval workflows, forexample add post-approval activities or additional stages. Refer to theOracle Fusion Applications Extensibility Guide for Developers.

See: Customizing and Extending SOA Components

Define Help Configuration 6-1

6Define Help Configuration

Define Help Configuration: Overview

The Define Help Configuration task list contains tasks that let you set up andmaintain Oracle Fusion Applications Help for all users. Use the Set Help Optionstask to determine if certain aspects of Oracle Fusion Applications Help areavailable to users and to control how aspects of the help site work. Use theAssign Help Text Administration Duty and Manage Help Security Groups tasksto set up customization of help content.

After performing the help configuration tasks, you can review the predefinedhelp and consider whether to add or customize any content. Help that isembedded in the application, for example hints, can also be customized.

Use the Setup and Maintenance work area to access the tasks in the Define HelpConfiguration task list.

Set Help Options

Help Feature Choices and Help Options: Points to Consider

Help feature choices on the Configure Offerings page in the Setup andMaintenance work area control the look and behavior of Oracle FusionApplications Help, and also determine which help options are available. Helpoptions are setup options on the Set Help Options page.

Local Installation of Help

Select the Local Installation of Help feature choice so that the Define HelpConfiguration task list appears in your implementation project, and you canselect two additional features (Access to Internet-Based Help Features and HelpCustomization) to control the fields available on the Set Help Options page.


Access to Internet-Based Help Features

Select this feature choice to provide users access to features that involvenavigation to sites on the Web. If you select this feature choice, then the WebSites Available from Help Site section is available on the Set Help Options page.For Oracle Cloud, always leave this feature choice selected so that your users canaccess the Cloud Learning Center.

Help Customization

Select the Help Customization feature choice if you intend to customizepredefined help or add your own files to help. For example, you can add internalpolicies or procedures as help, and Oracle User Productivity Kit content, if any.Only users with job roles containing the Application Help Text Administrationduty role have access to customize help.

If you select this feature choice, then the Custom Help Security feature choice isavailable, as well as all these sections on the Set Help Options page:

• Custom Help

• User Productivity Kit

• Privacy Statement

Custom Help Security

Select this feature choice if you want certain help files to be available onlyto a restricted set of users. You can define the user groups allowed to viewcorresponding help files. Do not select this feature choice if you do not have thisrequirement, because the feature can have an impact on performance.

If you select the Custom Help Security feature choice, then the Manage HelpSecurity Groups task is available in the Define Help Configuration task list inyour implementation project. There are no help options associated with thisfeature choice.

Administering Collaboration Features and Announcements in Help: Points to

Consider

Announcements and collaboration features (discussions, ratings and comments)allow users to share information regarding help and the subjects that particularhelp files cover. The collaboration features are also used elsewhere in OracleFusion Applications. Discussions may not be available in Oracle Cloudimplementations.

Use the Set Help Options page in the Setup and Maintenance work area toenable the announcements and discussions features and to set options aboutratings. When administering these features, consider the purpose of each featureand points that are specific to Oracle Fusion Applications Help.


Announcements

Use announcements to broadcast information to all users of your help site. Youcan provide information about help, for example new custom help that wasrecently added, or about anything that users should take note of, for examplea change in company policy. Announcements can appear on any of the tabson the home page of Oracle Fusion Applications Help. You can target specificuser groups by posting announcements to specific tabs, for example, postinginformation related to implementation to the Functional Setup tab.

Only users with the Application Help Text Administration duty role have accessto the Manage Announcements icon button in the Announcements sections.They can create, edit, and delete announcements for the tab that they are on, andset the date range for when each announcement is to be displayed.

Note

Use the full URL, for example http://www.oracle.com, when creating links.

Discussions

Users can use discussions to post questions or comments about subjects coveredin specific help files. For example, after reading help on expense reports, usersmight have questions or comments about company policies or processes forexpenses. Other users who later access this help file would benefit from theinformation in the discussion.

You can set a help option to enable discussions. Each help file would containa Discuss link that all users can use to read discussions about that file. Theycan also start a discussion topic or post to existing topics. These discussions arevisible only to users in your enterprise.

Important

Do not enable discussions until servers for discussions are up and running.

Ratings and Comments

Users can rate any help file on a five star system and provide feedback about thecontent. This information is helpful to other users in deciding which help file toopen. Help files with a higher average rating are listed first in help windows,and in the help listings you see as you browse using the help navigators.

The scope of ratings and reviews is limited to your enterprise.

FAQs for Set Help Options

When do I link to the Oracle User Productivity Kit library from the help site?

Provide a link to your Oracle User Productivity Kit (UPK) library if you haveUPK licensed and custom UPK content to share with your users. You give them


access to a library of custom UPK content in addition to any custom UPK demosthat you added to the help site itself. UPK demos that you add as custom helpare available only in the See It mode, so the library can include the same demoin other modes. If you have UPK versions earlier than 3.6.1, then you cannot addUPK demos as custom help, so the link is the only way for users to access customUPK content from the help site.

How can I find the URL to the Oracle User Productivity Kit library?

The URL to enter on the Set Help Options page should be the full path fromthe Web server where you are hosting your Oracle User Productivity Kit (UPK)content to the index.html file that opens the table of contents for the library, forexample, http://<your domain>.com/UPKcontent/PlayerPackage/index.html.In this example, you or your UPK administrator would publish one UPKplayer package that contains all the content to be linked to from Oracle FusionApplications Help, as well as the index.html file, and place the PlayerPackagefolder in a manually created folder called UPKcontent on the Web server.

FAQs for Assign Help Text Administration Duty

Who can add and manage custom help?

Users with the Application Help Text Administration duty role have access tocustomize help in Oracle Fusion Applications Help. This duty is assigned bydefault to various job roles, in particular the administrators for product families.

You can assign the duty role to other users who need access to customize help.Use the Manage Duties task in the Setup and Maintenance work area to searchfor the Application Help Text Administration duty role on the Role Catalog page,and map additional job roles to this duty role.

Manage Help Security Groups

Creating Help Security Groups: Worked Example

This example demonstrates how to create a help security group to define a set ofjob roles that have access to help. The help security group can then be assignedto particular help files so that only users with any of the defined roles haveaccess to the help.



What type of users do you need to limit help accessto?

Human resources (HR) specialists


Is there a specific time period for which this access isneeded?

No, the help files should always be viewed only bythe HR specialists

Where do you want this group to appear in the list ofvalues for help security groups?

First

Define a help security group and assign a duty role to the group.

1. From the Setup and Maintenance work area, find the Manage HelpSecurity Groups task and click Go to Task.

2. On the Manage Help Security Groups page, add a new row.

3. Complete the fields, as shown in this table. Leave the start and end datesblank.

Field Value

Help Security Group HR

Meaning HR Only

Description Viewing by HR specialists only

Display Sequence 1

4. Click Save.

5. With your new help security group selected, go to the Associated Rolessection and add a new row.

6. Select PER_HUMAN_RESOURCE_SPECIALIST as the role name.

7. Click Save and Close.

You have created a new lookup code for the Help Security Groupslookup type, which is a standard lookup. The lookup code has the name,meaning, and description that you defined for the help security group.

You have also created a data security policy for the help databaseresource, specifying that the Human Resource Specialist role can viewhelp that is defined with the HR security group. If you go to the ManageDatabase Resources and Policies page and find the database resource,or object, ATK_KR_TOPICS, then you can see the policy for the HumanResource Specialist role, with the condition that the column name,SECURITY_CODE, is equal to the value HR.

Help File Customization

Help File Customization: Overview

If you have the appropriate job roles, then you can customize the help files inthe help site. Use the Manage Custom Help page to maintain both predefinedand custom help files. You can create, duplicate, edit, and delete custom files, or


set their status to Active or Inactive. For predefined files, you can only duplicatethem or set their status. For each help file, predefined or custom, use helplocations to determine where the help file appears in the application and in thehelp site. You have various options in how you add custom help, for example byuploading a file or specifying a URL.

Note

• To make a copy of all custom help for testing, migration, or otherpurposes, create a configuration package then use the export and importfeature in the Setup and Maintenance work area. The configurationpackage must use a source implementation project that contains theDefine Help Configuration task list and you must select the followingobjects to export: Help Configuration and Help Topic.

There are various ways to access help customization.

• Many help files can be accessed from help windows in the application. Ifyou want to customize help in the context of a help window, for examplecreate a custom help file and add a link to it from a specific help window,then start by opening that help window. When you click the ManageCustom Help link, you go to the Manage Custom Help page, and the helplocation fields are automatically populated with values that correspondto the help window. This way you can easily select existing files to addto the same help location, and when you create a new file, the same helplocation appears by default.

Restriction

Aside from links to help files, some help windows also display informationaltext. You can't use the Manage Custom Help page to edit this text. Your technicaladministrators can do so using developer tools (not available in Oracle Cloudimplementations).

• Open the Manage Custom Help page directly from the home page ofOracle Fusion Applications Help or from search result pages.

• To edit a specific file, you can either find it in the Manage Custom Helppage, or open the file itself and click the Edit link.

• Likewise, you can find glossary terms in the Manage Custom Help page,or go to Navigator - Glossary in Oracle Fusion Applications Help toopen the Glossary tab, search for the term, and click Edit.

Tip

When you search in the Manage Custom Help page, make sure that the CustomHelp Only check box is not selected if you are looking for predefined help.

If your enterprise has purchased Oracle User Productivity Kit (UPK) content,then your administrator can also add a UPK item to the Settings and Actionsmenu in the global area of Oracle Fusion Applications. When users select thismenu item, they access UPK content specific to the page that they are on.


Help Types: Explained

Oracle Fusion Applications Help contains various types of help content,including demos, examples, FAQs, glossary terms, help topics, and PDF guides.A business process or product can be supported by some or all of these helptypes.

Demo

Demos are Oracle User Productivity Kit (UPK) topics that visually demonstratehow to use the application to complete a short task or portion of a task. Demoscan also provide an introduction to complex dashboards and work areas.

Example

Examples provide real use cases of features to illustrate how and when to usethe feature, or scenarios to illustrate abstract concepts. Worked examples showexactly what you need to do to achieve a specific result, emphasizing decisionsthat you make and values that you enter.

FAQ

FAQs, or frequently asked questions, provide brief answers to questions that youmight have regarding a task or page. For example, they can briefly explain whata term means, why something happened, how you can perform an action, orwhat happens if you perform the action.

Glossary

Glossary terms provide definitions for words or phrases used in help. Youcan search or browse glossary terms in the Glossary tab of Oracle FusionApplications Help. Where the links are available, you can also see the definitionwhen you hover over the term in help content for other help types.

Help Topic

Help topics explain key concepts, illustrate how application components worktogether, or assist in decision-making by explaining points to consider or theoptions you have. Help topics can also provide reference, overview, and otherinformation.

PDF Guide

PDF guides in Oracle Fusion Applications Help provide, in a book format,information usually not found in other help types. There are other guides thatpresent a collection of help content from the other help types, except demos, inan organized and logical format. These guides, for example, address specific


business processes and setup offerings. You can find these guides by going to Navigator - Documentation Library in Oracle Fusion Applications Help.

Help Locations: Explained

Help locations determine where users can find help files, custom or not, fromeither the application or the help site.

Help locations include:

• Page or section values

• Help hierarchies

• Primary locations

Page or Section Values

The value in the Page or Section field on the help customization pagesrepresents where users can click a help icon to open a help window that containsa link to the help file. In most cases, this value represents a page or region headerin the application. Help windows are also available on specific tabs or windows,and in the Setup and Maintenance work area for specific task lists or tasks. Youcan associate a help file with multiple page or section values, or with none at all.

The page or section value reflects the logical navigation to the help window. Forexample, Edit Opportunity page, Revenue tab, Recommendations windowdoes not mean that the help file is available in three different places. The helpicon is in the Recommendations window, which is accessed from the Revenuetab on the Edit Opportunity page.

If the value suggests multiple locations, for example Create and EditOpportunity pages, then the help file is available from the page header of boththe Create Opportunity and Edit Opportunity pages. If the page or section valueis, for example, a dashboard region that appears in multiple dashboards, thenthe value does not specify the page name but just the region. The help file isavailable from that region in multiple dashboards.

Help Hierarchies

Help files are associated with help hierarchies, which are used to categorize helpfiles and aid users in finding help. Each help file can have multiple hierarchies,with at least one of type Business Processes. The business process hierarchy isbased on the Business Process Management model. Every page or section valueis predefined with a specific business process hierarchy. If you select a page orsection without entering a business process hierarchy, the predefined hierarchyappears by default.

The Common Tasks navigator is based on the Welcome hierarchy type. The level1 nodes represent categories of functional areas common to all users.

The Business Processes navigator in the help site is based on the business processhierarchy. For example, if you assign two business process hierarchies to a help


file, users can find the file in both locations in the navigator. When the user clicksMore Help from a help window, all help files assigned to the same businessprocess hierarchy as the page or section value are returned as search results.

Similarly, the Products navigator is based on the Product hierarchy type, inwhich level 1 is the product family, level 2 is the product, and level 3 is thebusiness activity owned by that product.

The Functional Setup navigator is based on the Functional Setup hierarchy type.The level 1 nodes for this hierarchy are:

• Functional Setup Manager, which includes help about using the Setupand Maintenance work area.

• Offerings, which contains level 2 nodes for each setup offering, and lowerlevels for the main task lists in the offerings. Help for the task lists andtasks are included.

Primary Locations

The primary location of a help file designates the hierarchy that is displayedfor the help file in search results and within the help content as breadcrumbs.You cannot change the primary location of a help file that came with your helpinstallation. Primary locations of predefined help are based on the businessprocess hierarchy, while custom help files can have primary locations based onhierarchies of any type.

Editing Predefined Help and Glossary Terms: Points to Consider

When you open any predefined help file, including glossary terms, that camewith Oracle Fusion Applications Help, you can see an edit option if you haveroles allowing edit access. When you edit predefined help, keep in mind:

• What happens to the original help file

• Where predefined help appears

• Considerations specific to glossary terms

What Happens to the Original Files

When you edit predefined help, you are actually creating a new custom help filebased on the original file, with the same help locations. The customized versionreplaces the original, which becomes inactive and hidden from users. You candisplay both versions by reactivating the original in the Manage Custom Helppage.

Note

In the Search Results: Existing Help region on the Manage Custom Help page,there is no option to edit predefined help. You can duplicate a predefined helpfile, edit the copy, and optionally inactivate the original.


Where Predefined Help Appears

All predefined help comes with preassigned help locations, including at least onebased on the hierarchy of type Business Processes. Many also have predefinedpage or section values that indicate where the help can be accessed from helpwindows in the application.

To change where predefined help appears, either in the help site navigators or inthe application, create a duplicate in the Manage Custom Help page. Change oradd help locations to your custom copy, and inactivate the original.

Even though glossary terms do not appear in the help site navigators, you stillneed to enter at least one help location to categorize the glossary term.

Considerations Specific to Glossary Terms

When you edit a predefined glossary term, the original term becomes inactive.Existing links to the glossary term, from other predefined and custom helpfiles, will automatically point to your custom version. If you later inactivate thecustom glossary term, make sure to activate the original term so that the linksstill work.

Links in Custom Help: Points to Consider

When you create or edit custom help, follow best practices when you includelinks to help files or other content. If you are working on custom help createdby duplicating a predefined help file, then you may see existing links from theoriginal file in the Help Content section. The types of links that you can workwith include:

• Related help links

• Standard hypertext links

• Links to documentation library content

• Glossary term links

For all link types, except the standard hypertext links, you must create or editcustom help with a Text or Desktop source type. In other words, you must typethe help content directly in the application or use an HTML file that you uploadto help. For standard hypertext links, the source type can also be URL.

Related Help Links

Related help is the section at the end of help files that contains links to other helpfiles. The syntax for related help contains a comma-separated list of title IDs thatrepresent help files.

This figure provides an example of related links code.


• You can delete this code to remove all related help, ordelete title IDs to remove individual links (for example,CREATE_AUTOMATIC_POSTING_CRITERIA_S_0000).

• To replace existing links or add new links, you need to retain the codesyntax and enter desired title IDs. To find title IDs, search for the help fileson the Manage Custom Help page. Title IDs are displayed in the searchresults, but the Title ID column is hidden by default.

Standard Hypertext Links

You can create standard hypertext links to any file or Web site as long as youensure the stability and validity of the links, including links to other help files,custom or not. These links can appear anywhere in the body of your help file aslong as they come before any related help links.

In the Help Content section, highlight the text that you want to use as link textand click the Add Link icon button.

For links to other help files, open the file to which you want to link, and click theE-Mail link. Use the URL in the autogenerated e-mail text as the link to the file.

Note

Use the full URL, for example http://www.oracle.com, when creating links.

Links to Documentation Library Content

The syntax for links to HTML files in documentation libraries is:

<span class="HP_topic-link_bridgeDocument-linkToSTDoc_"><?ofa

linkToSTDoc(WCSUG4636) ?><span class="HP_topic-linktext_">Understanding

Tags</span><?ofa endLink ?></span>.

WCSUG4636 is the anchor ID and Understanding Tags is the link text. You can:

• Modify the link by replacing the existing anchor ID or editing the linktext, or both.

• Remove the link by deleting all the code for it.

• Create links to documentation library content by following the samesyntax. These links can appear anywhere in the body of your help file aslong as they come before any related help links.

Important

To ensure that you are linking to a supported documentation library, enteranchor IDs only from documentation libraries that are linked from predefinedhelp topics.

Glossary Term Links

Glossary term links provide definitions in a note box when users hover over theterm in help files.

This figure shows an example of code for a glossary term link.


In this example, accounting period is the link text, or glossary term, andACCOUNTING_PERIOD_001 is the identifier, or title ID.

• To remove the link but retain the text, delete all the code except the termitself.

• To add glossary term links, you must follow the link syntax and use thecorrect title ID for the glossary term. You can find title IDs in the searchresults of the Manage Custom Help page.

Note

If your custom help has glossary terms and the source type is Desktop File, thenmake sure before uploading that the quotes around the glossary term are actualquotation marks in raw HTML, not &QUOT. Otherwise, quotation marks willappear when users view the help file.

Customizing PDF Guides: Worked Example

This example demonstrates how to customize a PDF guide that came withOracle Fusion Applications Help. This guide is currently not available from anyhelp window in the application.



What changes do you need to make to the guide? Change the title of a chapter and remove a sectionin that chapter, to hide content about a particularsubject

Which help window should the customized guideappear in?

The help window for the entire Welcome dashboardof Oracle Fusion Applications

Which help navigators should the customized guideappear in, and on which node?

Same as the original guide, plus the path associatedwith the help window

Do you want to limit access to the customizedguide?

No, same as the original guide

Edit a copy of the original PDF guide, and use the Manage Custom Help page toreplace the original PDF guide with your new file.

Copying and Editing the PDF Guide

1. Open the original PDF guide from the help site and save a copy to yourdesktop. Leave open the help file for the guide.

2. Using a PDF editor application, change the title of the chapter whereverthe chapter title appears. Delete the content you want to hide from users.

Replacing the Original PDF Guide

1. In the help file that you still have open for the original PDF guide, clickthe Edit link.


2. On the Create Help page, use the default values except where indicated.

3. Update the title to the name that you want to display to users.

4. In the File Name field, browse for and select your customized guide.

5. Delete any keywords or parts of the description relevant to the contentyou removed from the PDF guide.

6. Add a help location with the Business Processes hierarchy type andselect Information Technology Management as the level 1 node,Manage Enterprise Application Software as the level 2 node, and UseApplications as the level 3 node.

7. Select Welcome page in the Page or Section column.

8. Click Save and Close. The help file for the original PDF guide isautomatically set to inactive.

Adding Custom UPK Content to Help: Worked Example

This example demonstrates how to add custom Oracle User Productivity Kit(UPK) topics as demo help files. These help files function like any predefinedhelp file for demos. You can search and include these files in help windows andnavigators as you would other help.

In this scenario, you are adding one demo about activity streams, to appear in ahelp window on the Welcome dashboard.

Note

Your demo must be made with UPK 3.6.1 or later to be added as help.



What UPK content do you want to add to help? From a UPK module containing five topics, add oneas a custom demo on the help site

Which help navigators should the demo appear in,and on which node?

Because the demo is about activity streams:

• Search by Common Tasks navigator, under theCollaboration node

• Search by Business Process navigator, under Information Technology Management- Manage Collaboration - ManageCollaborative Communities

Which help window should the demo appear in? On the Welcome dashboard of Oracle FusionApplications, in the help window in the ActivityStream region

Do you want to limit access to the help file for thedemo?

No

Do you want the help file to appear in the New andUpdated pane?

Yes


Generate a report of UPK document IDs, which you will use when creatingcustom help, to identify the UPK topic that you want to add. Publish the UPKmodule as a player package, then create custom help for the UPK topic that youwant to use as a help demo.

Generating a UPK Document ID Report

1. In the UPK Developer, select Details View.

2. Right-click any column header, for example Name, and select ColumnChooser.

3. In the Column Chooser dialog box, click and drag the Document IDcolumn header and drop it after the Name column. Close the ColumnChooser dialog box.

4. From the File menu, select to print, and save the output as a MicrosoftExcel file to your desktop.

Creating the Player Package

1. From the UPK Developer, make sure that the topic that you want to addas a demo has the See It play mode. The topic can also have other modes,but only the See It mode is included in the custom help file.

2. Publish the module, specifying any location for the output and selectingto publish the selection only.

3. In the Formats section of the Publish Content window, select the Playercheck box under the Deployment check box group.

4. In the Player section, select the Include HTML Web Site check box, toensure that the custom help file includes a text-only version of the UPKtopic.

5. Finish the publishing process, after optionally setting other options.

6. Navigate to the location where you specified the output to be generated.

7. In the Publishing Content folder, copy the PlayerPackage folder and addit to the web server where you store UPK content.

Creating Custom Help for Demos

1. Open the help window in the Activity Stream region on the Welcomedashboard of Oracle Fusion Applications, and click Manage CustomHelp.

2. On the Manage Custom Help page, the page or section and hierarchyvalues are populated with the values for the Activity Stream region.

3. Click Create.

4. On the Create Help page, complete the fields in the General Informationsection, as shown in this table. Use the default values except whereindicated.

Field Value

Title The name of the UPK topic.

Source Type Oracle User Productivity Kit


File Location The full URL of the player package

folder on the Web server, for example,

http://<your domain>.com/

UPKcontent/PlayerPackage.

Document ID The document ID of the UPK topic to

add to the help window in the Activity

Stream region. You can copy and paste

this ID from the Microsoft Excel file

that you generated earlier.

Help Type Demo

Help Security Group Unsecured

Keywords Terms relevant to the demo.

Description Summary of the demo.

Include in New and Updated pane Selected

The Help Location section contains values for the help window in theActivity Stream region. This help file will also appear in the Search byBusiness Process navigator under this predefined hierarchy.


6. On the Manage Custom Help page, open the help locations for the helpfile that you just created.

7. Add a help location with the Welcome hierarchy type and selectCollaboration Features as the level 1 node.


FAQs for Help File Customization

How can I restrict help content to specific user roles?

When you create or edit help, select a help security group that represents the setof roles that you want to have access to the help. If you do not see the SecurityGroup field, then your administrator has not selected the Custom Help Securityfeature choice. The Unsecured group has no associated roles, so anyone can viewthe help. The predefined Secured group includes all internal employees andcontingent workers, unless this group has been edited. You can create securitygroups and associate roles using the Manage Help Security Groups page, whichyou can access by starting in the Setup and Maintenance Overview page andsearching for the Manage Help Security Groups task. Your new security groupsare immediately available for use to secure new or edited help files.

Why can't I select and add help to a location?

You must specify a page or section to add the existing help to. To ensure thathelp is added to the correct help window, go to the page or section in theapplication, click the Help icon, and click the Manage Custom Help link in thehelp window. Alternatively, in the Manage Custom Help page, search for at least


a page or section and a level 1 value for the Business Processes hierarchy typebefore selecting the Select and Add option.

You cannot select and add help to a particular hierarchy, on the Manage CustomHelp page, without a page or section. To add just a hierarchy, search for the helpfile, add a new help location, and specify only the hierarchy information.

What happens to custom help when a help patch is applied?

Oracle Fusion Applications Help patches update all help files, both active andinactive, except custom help. Custom help files are not affected by patches.Consider reviewing inactive files to see if you want to activate the updatedversion, or to make similar edits to the custom versions of those files, if any.

Embedded Help Customization

Customizing Embedded Help: Highlights

You can customize help that is embedded in the application, for examplehints, for all users of Oracle Fusion Applications. There are different types ofembedded help.

Creating, Editing, or Deleting Help

• Use Page Composer to edit, create, or delete hint text that appears onhover over buttons, links, icons, or tab titles. Open the properties of the UIelement to define the help text in the shortDesc field. Usually, the valueresolves to a key in a resource bundle.

• Edit, create, or delete other types of embedded help. Refer to theCustomizing or Adding Static Instructions, In-Field Notes, andTerminology Definitions section.

See: Oracle Fusion Applications Extensibility Guide for Developers

Define Application Toolkit Configuration 7-1

7Define Application Toolkit Configuration

Define Application Toolkit Configuration: Overview

Oracle Fusion Application Toolkit (ATK) is an application that provides variouscore components of Oracle Fusion Applications, including the Welcomedashboard, Oracle Fusion Applications Help, the Reports and Analytics pane,and the Watchlist feature. Use the Define Application Toolkit Configurationtask list to set up and maintain some of these components for all users, and theDefine Help Configuration task list for Oracle Fusion Applications Help.

Note

The Define Application Toolkit Configuration task list is available inimplementation projects only if the Application Toolkit Component Maintenancefeature choice is selected.

Use the Setup and Maintenance work area to access the tasks in the DefineApplication Toolkit Configuration task list.

Map Reports to Work Areas

Additional Report Setup in the Context of the Reports and Analytics Pane:

Highlights

Aside from determining which work areas a specific report is mapped to, youcan perform additional setup for reports in the context of the Reports andAnalytics pane. You can set up report permissions, and enable Oracle BusinessIntelligence (BI) Publisher reports for scheduled submission.

This additional setup is described in the Oracle Fusion Middleware User'sGuide for Oracle Business Intelligence Enterprise Edition and the Oracle FusionApplications Extensibility Guide for Business Analysts.


Report Permissions

• You can restrict access to specific reports for specific users, and thissecurity is not limited to the Reports and Analytics pane. Refer to theOracle Fusion Middleware User's Guide for Oracle Business IntelligenceEnterprise Edition.

See: Assigning Permissions

Oracle Business Intelligence Publisher Reports Submission

• Oracle BI Publisher reports must be registered as processes with OracleEnterprise Scheduler to be enabled for scheduling. This registration alsoenables a Schedule link for the report in the Reports and Analytics Pane.Refer to the Oracle Fusion Applications Extensibility Guide for BusinessAnalysts, and perform the following steps in the specified order.

• Create an Oracle Enterprise Scheduler job definition for the report.

• Specify the job definition details in the report's properties.

FAQs for Map Reports to Work Areas

How can I set up the Reports and Analytics pane for all users?

You can remove any currently mapped report from the Reports and Analyticspane, or add mappings to reports from the Oracle Business Intelligence (BI)Presentation catalog. To access the setup, click Edit Settings in the Reportsand Analytics pane, or use the Map Reports to Work Areas task in the Setupand Maintenance work area. If you do the former, then you can set up only theReports and Analytics pane on the work area that you are in.

If you do the latter, then you can select a work area to set up. If you do not seethe desired work area, most likely you do not have access to it due to security.You can request to be granted a role that has access to the work area, or anotheradministrator or business user with access to the work area can be granted theReports and Analytics Region Administration Duty to be able to map reports tothe work area.

Tip

On the Map Reports to Work Areas page only, you can also use the Synchronizebutton to remove mappings to reports that are no longer in the catalog, for allwork areas at once.

Any changes you make in either UI apply to all users with access to the mappedwork area.

Why can't I see reports when mapping reports to work areas for the Reports

and Analytics pane?

It is possible that there are no reports currently mapped to the work area thatyou select in the Map Reports to Work Areas page. Alternatively, reports aremapped, but you do not see them due to security.


Similarly, in the list of all available reports from the catalog, you can see onlythe reports that you have access to. You can request to be granted a role that hasaccess to the reports that you want to map, or another administrator or businessuser with access to those reports can be granted the Reports and AnalyticsRegion Administration Duty to be able to map reports to work areas.

Why can't I see reports when I edit settings for the Reports and Analytics pane?

In the Edit Settings window, you may not be able to see a currently mappedreport because you do not have access to it due to security.

Similarly, in the list of all available reports from the catalog, you can see onlythe reports that you have access to. You can request to be granted a role that hasaccess to the reports that you want to map, or another administrator or businessuser with access to those reports can be granted the Reports and AnalyticsRegion Administration Duty to be able to map reports to work areas.

Set Watchlist Options

Watchlist Setup: Points to Consider

For all users across the site, you can disable or enable predefined Watchlistcategories and items, edit their names, and determine how often item countsrefresh. You cannot delete predefined Watchlist categories and items, nor createany for the site. Users can create their own Watchlist items through savedsearches.

Access the Set Watchlist Options page by starting in the Setup and MaintenanceOverview page and searching for the Set Watchlist Options task.

Disabling Predefined Categories and Items

Use the Set Watchlist Options page to enable or disable predefined Watchlistcategories and items. Disabling any category or item also disables associatedprocesses involved in calculating the Watchlist item counts for all users. Theseprocesses include creating data caches, performing security checks, invokingservices across domains, running queries, and so on.

An item with the Predefined type represents the actual predefined Watchlistitem that appears in the Watchlist. If you disable this type of Watchlist item, then:

• The item is not available for users to display in their watchlist

• The item is removed from any watchlist where it is currently displayed

A Watchlist item with the User-created saved search type does not appear in theWatchlist; it controls the display of the Manage Watchlist button or menu item inpages with saved searches. If you disable this type of Watchlist item, then:

• The Manage Watchlist option is not available to users in thecorresponding work area, so users cannot use their own saved searches as


Watchlist items. A message is displayed to users when they try to use thisoption.

• Any user-defined saved searches from that work area already used asWatchlist items are no longer available in the users' watchlist. The user-defined saved searches are still available to be used for searching, but notfor the Watchlist.

If you disable a Watchlist category, then the category is not available for usersto include in their watchlist, and all Watchlist items within the category are alsodisabled.

Ultimately, the Watchlist for any user contains the subset of categories and itemsthat are enabled in the Set Watchlist Options page:

• Plus any items based on user-defined saved searches

• Minus any categories or items that the user chooses to hide usingWatchlist preferences

• Minus any items with no results found, if the user chooses to hide suchitems using Watchlist preferences

Specifying Refresh Intervals

All Watchlist items have a predefined refresh interval, which controls howoften the query that calculates the count for a Watchlist item can be run. Usethe Set Watchlist Options page to edit the interval values. What you specifyas the refresh interval for a Watchlist item of type User-created Saved Searchapplies to all Watchlist items based on saved searches created by users on thecorresponding search page.

When the user is in the Welcome dashboard with the Watchlist open for at leasttwo and a half minutes, the query automatically runs for all Watchlist items ifno refresh already ran in this user session. To subsequently run the query again,users can manually refresh the Watchlist region. The Refresh icon is enabledafter five minutes since the last refresh.

Note

During a refresh, the query runs for an individual Watchlist item only if the timesince the last query for this item is equal to or greater than the specified refreshinterval. Since the manual refresh of the entire Watchlist is not available until fiveminutes after the last refresh, you should not set a Watchlist item refresh intervalthat is less than five minutes.

When users open Watchlist from the global area, a refresh automatically runsif five minutes have passed since the last refresh. During this refresh, the queryruns for an individual Watchlist item only if the time since the last query for thisitem is equal to or greater than the specified refresh interval.

For example, you set the interval to eight minutes for a particular Watchlist item.When the user signs in and goes to the Welcome dashboard, with the Watchlistopen, the query automatically runs for this Watchlist item after two and a half


minutes. Every two and a half minutes after, a check is performed for stalecounts and new cached counts are displayed.

Five minutes after the query ran, the Refresh icon is enabled and the userperforms a manual refresh. However, the query does not run for this Watchlistitem, because the refresh interval is eight minutes. The user navigates away fromthe Welcome dashboard and opens the Watchlist from the global area six minuteslater. A refresh automatically runs because more than five minutes have passedsince the last refresh. This time, the query runs for this Watchlist item because ithas been more than eight minutes since the query last ran for this item.

Editing Predefined Category and Item Names

Predefined Watchlist category and item names are stored as meaningsof standard lookups. Lookup types for predefined categories end withWATCHLIST, for example EXM_EXPENSES_WATCHLIST. Edit the lookup typemeaning to change the category name. To change item names, edit lookup codemeanings for that lookup type.

Maintain Common Reference Objects 8-1

8Maintain Common Reference Objects

Maintain Common Reference Objects: Overview

The Maintain Common Reference Objects task list contains Oracle MiddlewareExtensions for Applications (Applications Core) tasks that supportimplementation of common behaviors, such as data security or reference datasets.

Use this task list to manage common reference objects that are definedcentrally and shared across applications, in addition to those that are specific toApplications Core functionality. You can access this task list by starting in theSetup and Maintenance Overview page and searching for common referenceobject task lists.

For more information on configuring custom objects, see the Oracle Sales CloudExtensibility Guide.

To make the Maintain Common Reference Objects task list available in yourimplementation project, go to Setup and Maintenance Overview - ConfigureOfferings , and for a specific offering, select the Maintain Common ReferenceObjects feature choice.

Define Application Taxonomy

Application Taxonomy: Highlights

Application taxonomy is the organization of Oracle application components andfunctions in a hierarchical structure, from product lines to logical business areas.This hierarchy represents a breakdown of products into units based on howapplications are installed and supported. Maintain this hierarchy on the ManageTaxonomy Hierarchy page, which you can access by starting in the Setup andMaintenance Overview page and searching for the Manage Taxonomy Hierarchytask.

A detailed introduction to application taxonomy is provided in the Oracle FusionApplications Developer's Guide.


Hierarchy

• The application taxonomy hierarchy contains various levels and types ofnodes, or modules.

See: Characteristics of the Level Categories

See: Benefits of a Logical Hierarchy

Usage

• Use application taxonomy to understand relationships amongapplications and between an application and its files. This information ishelpful in managing various phases of the product lifecycle.

See: How to Manage the Lifecycle

Modules in Application Taxonomy: Explained

A module is any node in the application taxonomy hierarchy. The top level of thehierarchy is product line, followed by product family, application, and logicalbusiness area. There can be multiple levels of logical business areas, with one ormore nested within a parent logical business area.

Product Line

A product line is a collection of products under a single brand name, forexample, Oracle Fusion.

Product Family

A product family is a collection of products associated with a functional area thatmay or may not be licensed together as a single unit, for example Financials.

Application

An application is a single product within a product family, containing closelyrelated features for a specific business solution, for example General Ledger.

Logical Business Area

A logical business area is a collection of business object definitions organizedinto a logical grouping. It contains the model objects, services, and UIcomponents for those business objects. Logical business areas have their ownhierarchy levels and in some cases can be two or three levels deep. Each leafnode has at least one business object and service, up to a maximum of fourbusiness objects and associated services. A logical business area with more thanfour business objects are further refined with child logical business area levels.Each of these parent-child levels is represented by a directory in the physicalpackage hierarchy.


Managing Modules in Application Taxonomy: Points to Consider

Manage modules on the Create Child Module or Edit Module page, whichyou can access by starting in the Setup and Maintenance Overview page andsearching for the Manage Taxonomy Hierarchy task. When you create a module,it is a child of the currently selected node in the application taxonomy hierarchy.This determines which values are available, for example for module type. Oncecreated, you cannot delete the module or move it elsewhere in the hierarchy.As you create or edit modules, consider the following points regarding specificfields.

Identifiers

Module ID is the unique primary key for nodes in the taxonomy table. Whenyou create a module, an ID is automatically generated. Once the module iscreated, you cannot update the ID.

Module key and alternative ID are additional identifiers of the module,presented in a way that is easier to read than the module ID. The module key is astring identifier, for example AP for the Oracle Fusion Payables application. Thealternative ID is a numeric identifier, for example 1 for the Oracle Fusion productline. These IDs are provided for the product line, product family, and applicationmodules, but you can optionally add them for logical business areas and newcustom modules.

Note

Do not change the module key or alternative ID for predefined modules.

The product code is relevant only to application and logical business areamodules. You can leave the field blank for other module types. The product codefor applications is the short name that can be displayed in lists of applicationvalues, for example FND for Oracle Middleware Extensions for Applications.

Names

Module name is the logical name for the module and is always available. Thename must be unique among nodes in the same hierarchy level with the sameparent, but try to make it as unique in the whole hierarchy as possible.

The user name and description can appear to users in other parts of OracleFusion Applications, so make sure that the values are something that users knowto represent the module.

Usage Types

Though you can update the usage type to reflect the current state of the module,just doing so does not affect the actual state. For example, setting a moduleas installed does not mean it is actually installed if the installation itself hasnot taken place. Installation refers to operations related to laying down all thecomponents needed to create an Oracle Fusion Applications environment, while


deployment is the process that starts the managed servers and clusters andfacilitates the actual use of product offerings. A licensed module is available forinstallation and deployment, and a deployed module is considered actively usedwhen actually used by users.

Seed Data

If seed data is allowed, then seed data such as flexfields and lookups can beextracted for the module using seed data loaders. By default, extract is allowedfor all predefined modules of type application and logical business area.

Associations

You can associate a logical domain to modules of type product family, as wellas one or more enterprise applications to modules of type application. Thisassociation represents the relationship between the taxonomy modules and thecorresponding domain and enterprise applications stored in the Oracle FusionApplications Functional Core (ASK) tables.

Define Reference Data Sharing

Reference Data Sharing: Explained

Reference data sharing facilitates sharing of configuration data such as jobs andpayment terms, across organizational divisions or business units. You definereference data sets and determine how the data is shared or partitioned. Usereference data sets to reduce duplication and maintenance by sharing commondata across business entities where appropriate. Depending on the requirement(specific or common), each business unit can maintain its data at a centrallocation, using a set of values either specific to it or shared by other businessunits.

You can share reference data after it is filtered on the basis of sets. A commonreference data set is available as the default set, which can be assigned to severalbusiness units sharing the same reference data. For commonly used data such ascurrencies, you can use the common reference data set and assign it to multiplebusiness units in various countries that use the same currency. In cases wherethe default set cannot be assigned to an entity, you can create specific sets. Thedata set visible on the transactional page depends on the sharing method used toshare reference data.

For example, XYZ Corporation uses the same grades throughout the entireorganization. Instead of managers in different business units setting up thesame grades, XYZ Corporation decides to create a set called Grades and assignthe grades reference data group for all business units in the organization to theGrades set, so that the grades can be shared.

Note

For specific information on configuring reference data sharing for a particularobject or product, refer to its product documentation.


Reference Data Sets: Explained

Reference data sets are logical groups of reference data that can be accessed byvarious transactional entities depending on the business context. Oracle FusionApplications contains a common reference data set as well as an enterprise setthat may be used as a default set. Depending on your business requirement youcan create and maintain additional reference data sets, while continuing to usethe common reference data set.

Consider the following scenario.

Your enterprise can decide that some aspects of corporate policy should affectall business units and leave other aspects to the discretion of the business unitmanager. This allows your enterprise to balance autonomy and control for eachbusiness unit. For example, if your enterprise holds business unit managersaccountable for their profit and loss, but manages working capital requirementsat a corporate level, you can let managers define their own sales methods, butdefine payment terms centrally. In this case, each business unit would haveits own reference data set for sales methods, and there would be one centralreference data set for payment terms assigned to all business units.

Partitioning

The partitioning of reference data and creation of data sets enable you to createreference entities across tables or lookup types, and share modular informationand data processing options among business units. With the help of partitioning,you can choose to create separate sets and subsets for each business unitdepending upon its business requirement, or create common sets or subsets toenable sharing reference data between several business units, without the needfor duplicating the reference data. Partitioning provides you the flexibility tohandle the reference data in a way appropriate to your business needs.

The following figure illustrates the reference data sharing method (assignment toone set only, with common values) where the user can access the data assignedto a specific set in a particular business unit, as well as access the data assignedto the common set.


Reference Data Sets and Sharing Methods: Explained

Oracle Fusion Applications reference data sharing feature is also known asSetID. The reference data sharing functionality supports operations in multipleledgers, business units, and warehouses, thereby reducing the administrativeburden and decreasing the time needed to implement new business units.For example, you can share sales methods, transaction types, or paymentterms across business units or selected other data across asset books, costorganizations, or project units.

The reference data sharing features use reference data sets to which referencedata is assigned. The reference data sets group assigned reference data. The setscan be understood as buckets of reference data assigned to multiple businessunits or other application components.

Reference Data Sets

You begin this part of your implementation by creating and assigning referencedata to sets. Make changes carefully as changes to a particular set will affectall business units or application components using that set. You can assign aseparate set to each business unit for the type of object that is being shared. Forexample, assign separate sets for payment terms, transaction types, and salesmethods to your business units.

Your enterprise can decide that some aspects of corporate policy should affectall business units and leave other aspects to the discretion of the business unitmanager. This allows your enterprise to balance autonomy and control for eachbusiness unit. For example, if your enterprise holds business unit managersaccountable for their profit and loss, but manages working capital requirementsat a corporate level, you can let managers define their own sales methods, butdefine payment terms centrally. In this case, each business unit would haveits own reference data set for sales methods, and there would be one centralreference data set for payment terms assigned to all business units.

The reference data sharing is especially valuable for lowering the cost of settingup new business units. For example, your enterprise operates in the hospitalityindustry. You are adding a new business unit to track your new spa services. Thehospitality divisional reference data set can be assigned to the new business unitto quickly setup data for this entity component. You can establish other businessunit reference data in a business unit specific reference data set as needed

Reference Data Sharing Methods

There are variations in the methods used to share data in reference data setsacross different types of objects. The following list identifies the methods:

• Assignment to one set only, no common values allowed. The simplestform of sharing reference data that allows assigning a reference dataobject instance to one and only one set. For example, Asset ProrateConventions are defined and assigned to only one reference data set.This set can be shared across multiple asset books, but all the values arecontained only in this one set.

• Assignment to one set only, with common values. The most commonlyused method of sharing reference data that allows defining reference data


object instance across all sets. For example, Receivables Transaction Typesare assigned to a common set that is available to all the business unitswithout the need to be explicitly assigned the transaction types to eachbusiness unit. In addition, you can assign a business unit specific set oftransaction types. At transaction entry, the list of values for transactiontypes includes transaction types from the set assigned to the business unit,as well as transaction types assigned to the common set that is sharedacross all business units.

• Assignment to multiple sets, no common values allowed. The methodof sharing reference data that allows a reference data object instance tobe assigned to multiple sets. For instance, Payables Payment Terms usethis method. It means that each payment term can be assigned to oneor more than one set. For example, you assign the payment term Net30 to several sets, but the payment term Net 15 is assigned to only yourcorporate business unit specific set. At transaction entry, the list of valuesfor payment terms consists of only one set of data; the set that is assignedto the transaction's business unit.

Note: Oracle Fusion Applications contains a reference data set called Enterprise.Define any reference data that affects your entire enterprise in this set.

Assigning Reference Data Sets to Reference Objects: Points to Consider

You can assign the reference data sets to reference objects on the ManageReference Data Set Assignments page. For multiple assignments, you can classifydifferent types of reference data sets into groups and assign them to referenceentity objects. The assignment takes into consideration the determinant type,determinant, and reference group, if any.

Determinant Types

The partitioned reference data is shared based on a business context settingcalled the determinant type. It is the point of reference used in the dataassignment process. The following table lists the determinant types used in thereference data assignment.

Type Description

Asset Book Information about the acquisition, depreciation, andretirement of an asset that belongs to a ledger or abusiness unit.

Business Unit The departments or organizations within anenterprise.

Cost Organization The organization used for cost accounting andreporting on various inventory and cost centerswithin an enterprise.

Project Unit A logical organization within an enterprise thatis responsible for enforcing consistent projectmanagement practices.

Reference Data Set References to other shared reference data sets.


Determinant

The determinant or determinant value is the value that corresponds to theselected determinant type. The determinant is one of the criteria for selecting theappropriate reference data set. For example, when managing set assignments forthe set determinant type, Reference Data Set is the determinant type, and youwould enter the corresponding set code value as the corresponding determinantvalue.

Reference Groups

A transactional entity may have multiple reference entities (generally consideredto be setup data) that are treated in the same manner because of commonness inimplementing business policies and legal rules. Such reference entities in yourapplication are grouped into logical units called reference groups, based on thefunctional area and the partitioning requirements that they have in common. Forexample, all tables and views that define Sales Order Type details might be partof the same reference group.

Note

The reference groups are predefined in the reference groups table and areavailable for selection and assignment.

Define ISO Reference Data

Defining Currencies: Points to Consider

When creating or editing currencies, consider these points relevant to enteringthe currency code, date range, or symbol for the currency.

Currency Codes

You cannot change a currency code after you enable the currency, even if youlater disable that currency.

Date Ranges

Users can enter transactions denominated in the currency only for the dateswithin the specified range. If you do not enter a start date, then the currency isvalid immediately. If you do not enter an end date, then the currency is validindefinitely.

Symbols

Even if you enter a symbol for a currency, the symbol is not always displayedwhen an amount is displayed in this currency. Some applications use currency


symbols when displaying amounts. Others, like Oracle Fusion General Ledger,do not.

Euro Currency Derivation: Explained

Use the Derivation Type, Derivation Factor, and Derivation Effective Date fieldsto define the relationship between the official currency (Euro) of the EuropeanMonetary Union (EMU) and the national currencies of EMU member states. Foreach EMU currency, you define its Euro-to-EMU fixed conversion rate and theeffective starting date.

Note

If you need to use a different currency code for Euro, you can disable thepredefined Euro currency and create a new one.

Derivation Type

The Euro currency derivation type is used only for the Euro, and the Euroderived derivation type identifies national currencies of EMU member states. Allother currencies do not have derivation types.

Derivation Factor

The derivation factor is the fixed conversion rate by which you multiply oneEuro to derive the equivalent EMU currency amount. The Euro currency itselfshould not have a derivation factor.

Derivation Effective Date

The derivation effective date is the date on which the relationship between theEMU currency and the Euro begins.

Natural Languages: Points to Consider

Natural languages are all the languages that humans use, written and spoken.If a language is enabled, then users can associate it with entities, for example aslanguages spoken by sales representatives. When managing natural languages,consider tasks to perform and best practices for entering particular values.

Tasks

Once you add a language, it cannot be deleted, just disabled. You can optionallyassociate natural languages with International Organization for Standardization(ISO) languages and territories, just for reference.


Values

When you create a natural language, use the alpha-2 ISO code as the languagecode, or, if not available, then alpha-3. If the language is not an ISO language,then use x- as a prefix for the code, for example x-ja for a Japanese dialect.Use the sgn code of ISO-639-2 for sign languages, followed by territory code,for example sgn-US for American Sign Language. You can also use InternetAssigned Numbers Authority (IANA) language tags.

The natural language description should be the language name with territoryname in parenthesis where needed, for example English (Australia) and English(Canada).

FAQs for Define ISO Reference Data

When do I create or edit territories?

Edit territory descriptions to determine how they are displayed in lists ofcountry values throughout Oracle Fusion Applications. The predefinedterritories are all countries from the International Organization forStandardization (ISO) 3166 standard. You usually would not edit territory namesor codes.

Do not edit National Language Support (NLS) territory codes, which areidentifiers used in the system, unless you need to change the association betweenISO and system territory. You usually would not edit the default currency, whichis the value that defaults in the Currency field in Oracle Fusion Applicationsuser preferences after the user first selects a territory.

Create territories if new countries emerge and the system has not yet beenpatched with the latest ISO country values.

When do I create or edit industries?

Edit industry descriptions to determine how they are displayed in Oracle FusionApplications. You usually would not edit industry names, which are from theNorth American Industry Classification System (NAICS). Enabled industries aremainly used in the context of customization, though these values can also appearin any application.

Create industries if you have particular ones you need, for example forcustomization, that are not included in the NAICS standard.

When do I associate industries with territories?

Optionally associate industries with territories to provide an industry in territoryvalue, used for customization. For example, administrators can customize a pagein one way for users within an industry in one country, and another way forusers within the same industry in another country. The administrator wouldselect the appropriate industry in territory value to set the customization context.


When do I create or enable currencies?

Create currencies to use, for example for reporting purposes, if they are notalready provided. All currencies from the International Organization forStandardization (ISO) 4217 standard are provided.

Enable any currency other than USD for use in Oracle Fusion Applications,for example for displaying monetary amounts, assigning to ledgers, enteringtransactions, and recording balances. Only USD is enabled by default.

What's the difference between precision, extended precision, and minimum

accountable unit for a currency?

Precision is the number of digits to the right of the decimal point used in regularcurrency transactions. Extended precision is the number of digits to the rightof the decimal point used in calculations for this currency, and it must begreater than or equal to the standard precision. For example, USD would have2 for precision because amounts are transacted as such, for example $1.00. Forcalculations, for example adding USD amounts, you might want the applicationto be more precise than two decimal digits, and would enter an extendedprecision accordingly.

Note

Some applications use extended precision. Others, such as Oracle Fusion GeneralLedger, do not.

Minimum accountable unit is the smallest denomination for the currency. Forexample, for USD that would be .01 for the cent. This unit does not necessarilycorrespond to the precision for all currencies.

What's a statistical unit currency type?

The statistical unit currency type is used only for the Statistical (STAT) currency.The Statistical currency is used to record statistics such as the number of itemsbought and sold. Statistical balances can be used directly in financial reports,allocation formulas, and other calculations.

When do I create or edit ISO languages?

You can edit the names and descriptions of International Organization forStandardization (ISO) languages to determine how they are displayed in listsof ISO language values in Oracle Fusion Applications. The ISO languages arefrom the ISO 639 standard. If there were changes to the ISO standard and thesystem has not yet been patched with the latest ISO values, you can update theISO alpha-2 code or add languages as needed.

When do I edit languages?

Installed languages automatically appear on the Manage Languages page,so you do not manually enter newly installed languages. This page contains


all languages available for installation and translation in Oracle FusionApplications. Each dialect is treated as a separate language. The language codesand names are values used by the system.

You generally would not edit any of the detailed fields unless you really need toand know what they are.

When do I create or edit time zones?

Though all standard time zones are provided, optionally enable only a subset foruse in lists of time zone values in Oracle Fusion Applications. You can add timezones if new zones became standard and the system has not yet been patchedwith the latest values.


Data Security in the Security Reference Implementation: Explained

The reference implementation contains a set of data security policies that canbe inspected and confirmed to be suitable or a basis for further implementationusing the Authorization Policy Manager (APM).

The security implementation of an enterprise is likely a subset of the referenceimplementation, with the enterprise specifics of duty roles, data security policies,and HCM security profiles provided by the enterprise.

The business objects registered as secure in the reference implementation aredatabase tables and views.

Granting or revoking object entitlement to a particular user or group of users onan object instance or set of instances extends the base Oracle Fusion Applicationssecurity reference implementation without requiring customization of theapplications that access the data.

Data Security Policies in the Security Reference Implementation

The data security policies in the reference implementation entitle the grantee (arole) to access instance sets of data based on SQL predicates in a WHERE clause.

Tip

When extending the reference implementation with additional data securitypolicies, identify instance sets of data representing the business objects thatneed to be secured, rather than specific instances or all instances of the businessobjects.

Predefined data security policies are stored in the data security policy store,managed in the Authorization Policy Manager (APM), and described in theOracle Fusion Applications Security Reference Manual for each offering. A data


security policy for a duty role describes an entitlement granted to any job rolethat includes that duty role.

Warning


The reference implementation only enforces a portion of the data securitypolicies in business intelligence that is considered most critical to riskmanagement without negatively affecting performance. For performance reasonsit is not practical to secure every level in every dimension. Your enterprisemay have a different risk tolerance than assumed by the security referenceimplementation.

HCM Security Profiles in the Security Reference Implementation

The security reference implementation includes some predefined HCM securityprofiles for initial usability. For example, a predefined HCM security profileallows line managers to see the people that report to them.

The IT security manager uses HCM security profiles to define the sets of HCMdata that can be accessed by the roles that are provisioned to users

Data Roles

The security reference implementation includes no predefined data roles toensure a fully secured initial Oracle Fusion Applications environment.

The security reference implementation includes data role templates that youcan use to generate a set of data roles with entitlement to perform predefinedbusiness functions within data dimensions such as business unit. Oracle FusionPayables invoicing and expense management are examples of predefinedbusiness functions. Accounts Payable Manager - US is a data role you mightgenerate from a predefined data role template for payables invoicing if you setup a business unit called US.

HCM provides a mechanism for generating HCM related data roles.

Data Security: Explained

By default, users are denied access to all data.

Data security makes data available to users by the following means.

• Policies that define grants available through provisioned roles

• Policies defined in application code

You secure data by provisioning roles that provide the necessary access.Enterprise roles provide access to data through data security policies defined forthe inherited application roles.


When setting up the enterprise with structures such as business units, data rolesare automatically generated that inherit job roles based on data role templates.Data roles also can be generated based on HCM security profiles. Data roletemplates and HCM security profiles enable defining the instance sets specifiedin data security policies.

When you provision a job role to a user, the job role implicitly limits dataaccess based on the data security policies of the inherited duty roles. When youprovision a data role to a user, the data role explicitly limits the data access of theinherited job role to a dimension of data.

Data security consists of privileges conditionally granted to a role and usedto control access to the data. A privilege is a single, real world action on asingle business object. A data security policy is a grant of a set of privilegesto a principal on an object or attribute group for a given condition. A grantauthorizes a role, the grantee, to actions on a set of database resources. Adatabase resource is an object, object instance, or object instance set. Anentitlement is one or more allowable actions applied to a set of databaseresources.

Data is secured by the following means.

Data security feature Does what?

Data security policy Grants access to roles by means of entitlement

Role Applies data security policies with conditions tousers through role provisioning.

Data role template Defines the data roles generated based on enterprisesetup of data dimensions such as business unit.

HCM security profile Defines data security conditions on instances ofobject types such as person records, positions, anddocument types without requiring users to enterSQL code

Masking Hides private data on non-production databaseinstances

Encryption Scrambles data to prevent users without decryptionauthorization from reading secured data

The sets of data that a user can access via roles are defined in Oracle Fusion DataSecurity. Oracle Fusion Data Security integrates with Oracle Platform SecurityServices (OPSS) to entitle users or roles (which are stored externally) with accessto data. Users are granted access through the entitlement assigned to the rolesor role hierarchy with which the user is provisioned. Conditions are WHEREclauses that specify access within a particular dimension, such as by businessunit to which the user is authorized.


Data security policies articulate the security requirement "Who can do Whaton Which set of data," where 'Which set of data' is an entire object or an objectinstance or object instance set and 'What' is the object entitlement.

For example, accounts payable managers can view AP disbursements for theirbusiness unit.


Who can do what on which set of data

Accounts payablemanagers

view AP disbursements for their business unit

A data security policy is a statement in a natural language, such as English, thattypically defines the grant by which a role secures business objects. The grantrecords the following.

• Table or view

• Entitlement (actions expressed by privileges)

• Instance set (data identified by the condition)

For example, disbursement is a business object that an accounts payablemanager can manage by payment function for any employee expenses in thepayment process.

Note

Some data security policies are not defined as grants but directly in applicationscode. The security reference manuals for Oracle Fusion Applications offeringsdifferentiate between data security policies that define a grant and data securitypolicies defined in Oracle Fusion applications code.

A business object participating in a data security policy is the database resourceof the policy.

Data security policies that use job or duty roles refer to data security entitlement.

For example, the data security policy for the Accounts Payable Manager job rolerefers to the view action on AP disbursements as the data security entitlement.

Important

The duty roles inherited by the job role can be moved and job roles reassembledwithout having to modify the data security.

As a security guideline, data security policies based on user session contextshould entitle a duty role. This keeps both function and data security policies atthe duty role level, thus reducing errors.

For example, a Sales Party Management Duty can update Sales Party wherethe provisioned user is a member of the territory associated with the salesaccount. Or the Sales Party Management Duty can update Sales Party wherethe provisioned user is in the management chain of a resource who is on thesales account team with edit access. Or the Participant Interaction ManagementDuty can view an Interaction where the provisioned user is a participant of theInteraction.

For example, the Disbursement Process Management Duty role includesentitlement to build documents payable into payments. The Accounts PayableManager job role inherits the Disbursement Process Management Duty role. Datasecurity policies for the Disbursement Process Management Duty role authorizeaccess to data associated with business objects such as AP disbursements within


a business unit. As a result, the user provisioned with the Accounts PayableManager job role is authorized to view AP disbursements within their businessunit.

A data security policy identifies the entitlement (the actions that can be made onlogical business objects or dashboards), the roles that can perform those actions,and the conditions that limit access. Conditions are readable WHERE clauses.The WHERE clause is defined in the data as an instance set and this is thenreferenced on a grant that also records the table name and required entitlement.

Data Roles

Data roles are implemented as job roles for a defined set of data.

A data role defines a dimension of data within which a job is performed. Thedata role inherits the job role that describes the job. For example, a data roleentitles a user to perform a job in a business unit.

The data role inherits abstract or job roles and is granted data security privileges.Data roles carry the function security privileges inherited from job roles and alsothe data security privilege granted on database objects and table rows.

For example, an accounts payables specialist in the US Business Unit may beassigned the data role Accounts Payables Specialist - US Business Unit. Thisdata role inherits the job role Accounts Payables Specialist and grants access totransactions in the US Business Unit.

A data role may be granted entitlement over a set people.

For example, a Benefits Administrator A-E is allowed to administer benefits forall people that have a surname that begins with A-E.

Data roles are created using data role templates. You create and maintain dataroles in the Authorization Policy Manager (APM). Use the Manage Data Rolesand Security Profiles task to create and maintain HCM data roles in OracleFusion HCM.

HCM Security Profiles

HCM security profiles are used to secure HCM data, such as people anddepartments. You use HCM security profiles to generate grants for an enterpriserole. The resulting data role with its role hierarchy and grants operates in thesame way as any other data role.

For example, an HCM security profile identifies all employees in the Financedivision.

Applications outside of HCM can use the HCM Data Roles UI pages to give theirroles access to HR people.

Masking and Encryption

Oracle Fusion Applications uses masking to protect sensitive data from view byunauthorized users. Encryption APIs mask sensitive fields in applications userinterfaces. Additionally, Oracle Data Masking is available for masking data innon-production instances and Oracle Transparent Data Encryption is available


for protecting data in transit or in backups independent of managing encryptionkeys.

Database Resources and Data Security Policies: How They Work Together

A data security policy applies a condition and allowable actions to a databaseresource for a role. When that role is provisioned to a user, the user has accessto data defined by the policy. In the case of the predefined security referenceimplementation, this role is always a duty role. Data roles generated to inheritthe job role based on data role templates limit access to database resources in aparticular dimension, such as the US business unit.

The database resource defines and instance of a data object. The data object is atable, view, or flexfield.

The following figure shows the database resource definition as the means bywhich a data security policy secures a data object. The database resource namesthe data object. The data security policy grants to a role access to that databaseresource based on the policy's action and condition.

Database Resources

A database resource specifies access to a table, view, or flexfield that is securedby a data security policy.

• Name providing a means of identifying the database resource

• Data object to which the database resource points



Data security policies consist of actions and conditions for accessing all, some, ora single row of a database resource.

• Condition identifying the instance set of values in the data object

• Action specifying the type of access allowed on the available values

Note

If the data security policy needs to be less restrictive than any available databaseresource for a data object, define a new data security policy.

Actions

Actions correspond to privileges that entitle kinds of access to objects, such asview, edit, or delete. The actions allowed by a data security policy include all or asubset of the actions that exist for the database resource.

Conditions

A condition is either a SQL predicate or an XML filter. A condition expressesthe values in the data object by a search operator or a relationship in a treehierarchy. A SQL predicate, unlike an XML filter, is entered in a text field in thedata security user interface pages and supports more complex filtering than anXML filter, such as nesting of conditions or sub queries. An XML filter, unlike aSQL predicate, is assembled from choices in the UI pages as an AND statement.

Tip

An XML filter can be effective in downstream processes such as businessintelligence metrics. A SQL predicate cannot be used in downstream metrics.

Securing Data Access: Points to Consider

Oracle Fusion Applications supports securing data through role-based accesscontrol (RBAC) by the following methods.

Method of securing data Reason Example

Data roles apply explicit datasecurity policies on job andabstract roles

Appropriate for job and abstractroles that should only access asubset of data, as defined by thedata role template that generatesthe data role or by HCM securityprofiles.

Accounts Payable Manager- US data role to provide anaccounts payable manager in theUS business unit with access toinvoices in the US business unit.

Data security policies Define data access for applicationroles and provide inheriting joband abstract roles with implicitdata security

Projects


If a user has access to the same function through different roles that accessdifferent data sets, then the user has access to a union of those data sets.

When a runtime session is created, Oracle Platform Security Services (OPSS)propagates only the necessary user to role mapping based on Oracle Fusion DataSecurity grants. A grant can specify entitlement to the following.

• Specific rows of data (data object) identified by primary key

• Groups of data (instance set) based on a predicate that names a particularparameter

• Data objects or instance sets based on runtime user session variables

Data is either identified by the primary key value of the row in the table wherethe data is stored. Or data is identified by a rule (SQL predicate) applied to theWHERE clause of a query against the table where the data is stored.

Grants

Oracle Fusion Data Security can be used to restrict the following.

• Rows that are returned by a given query based on the intended businessoperation

• Actions that are available for a given row

Grants control which data a user can access.

Note

Attribute level security using grants requires a data security policy to secure theattribute and the entitlement check enforces that policy.

A grant logically joins a user or role and an entitlement with a static orparameterized object instance set. For example, REGION='WEST' is a static objectinstance set and REGION=&GRANT_ALIAS.PARAMETER1 is a parameterized objectinstance set. In the context of a specific object instance, grants specify theallowable actions on the set of accessible object instances. In the database,grants are stored in FND_GRANTS and object instance sets are stored inFND_OBJECT_INSTANCE_SETS. Object access can be tested using the privilegecheck application programming interface (API).

Securing a Business Object

A business object is a logical entity that is typically implemented as a table orview, and corresponds to a physical database resource. The data security policiesof the security reference implementation secure predefined database resources.Use the Manage Data Security Policies task to define and register other databaseresources.

Data security policies identify sets of data on the registered business object andthe actions that may be performed on the business object by a role The grant canbe made by data instance, instance set or at a global level..


Note

Use parameterized object instance sets whenever feasible to reduce the numberof predicates the database parses and the number of administrative interventionrequired as static object instances sets become obsolete. In HCM, security profilesgenerate the instance sets.

Data Role Templates: Explained

You use data role templates to generate data roles. You generate such data roles,and create and maintain data role templates in the Authorization Policy Manager(APM).

Note

HCM data roles are generated using the Manage Data Roles and Security Profilestask, which uses HCM security profiles, not data role templates, to define thedata security condition.

The following attributes define a data role template.

• Template name

• Template description

• Template group ID

• Base roles

• Data dimension

• Data role naming rule

• Data security policies

The data role template specifies which base roles to combine with whichdimension values for a set of data security policies. The base roles are the parentjob or abstract roles of the data roles.

Note

Abstract, job, and data roles are enterprise roles in Oracle Fusion Applications.Oracle Fusion Middleware products such as Oracle Identity Manager (OIM)and Authorization Policy Manager (APM) refer to enterprise roles as externalroles. Duty roles are implemented as application roles in APM and scoped toindividual Oracle Fusion Applications.

The dimension expresses stripes of data, such as territorial or geographicinformation you use to partition enterprise data. For example, business unitsare a type of dimension, and the values picked up for that dimension by thedata role template as it creates data roles are the business units defined for your


enterprise. The data role template constrains the generated data roles with grantsof entitlement to access specific data resources with particular actions. The datarole provides provisioned users with access to a dimensional subset of the datagranted by a data security policy.

An example of a dimension is a business unit. An example of a dimension valueis a specific business unit defined in your enterprise, such as US. An exampleof a data security policy is a grant to access a business object such as an invoicewith a view entitlement.

When you generate data roles, the template applies the values of the dimensionand participant data security policies to the group of base roles.

The template generates the data roles using a naming convention specifiedby the template's naming rule. The generated data roles are stored in theLightweight Directory Access Protocol (LDAP) store. Once a data role isgenerated, you provision it to users. A user provisioned with a data role isgranted permission to access the data defined by the dimension and datasecurity grant policies of the data role template.

For example, a data role template contains an Accounts Payable Specialistrole and an Accounts Payable Manager role as its base roles, and region as itsdimension, with the dimension values US and UK. The naming conventionis [base-role-name]:[DIMENSION-CODE-NAME]. This data role templategenerates four data roles.

• Accounts Payable Specialist - US (business unit)

• Accounts Payable Specialist - UK (business unit)

• Accounts Payable Manager - US (business unit)

• Accounts Payable Manager - UK (business unit)

Making Changes To Data Role Templates

If you add a base role to an existing data role template, you can generate anew set of data roles. If the naming rule is unchanged, existing data roles areoverwritten.

If you remove a base role from a data role template and regenerate data roles, aresulting invalid role list gives you the option to delete or disable the data rolesthat would be changed by that removal.

Making Changes to Dimension Values

If you add a dimension value to your enterprise that is used by a data roletemplate, you must regenerate roles from that data role template to create adata role for the new dimension. For example if you add a business unit to yourenterprise, you must regenerate data roles from the data role templates thatinclude business unit as a dimension.

If you add or remove a dimension value from your enterprise that is used togenerate data roles, regenerating the set of data roles adds or removes the data


roles for those dimension values. If your enterprise has scheduled regenerationas an Oracle Enterprise Scheduler Services process, the changes are madeautomatically.

For information on working with data role templates, see the Oracle FusionMiddleware Administrator's Guide for Authorization Policy Manager.

Set Activity Stream Options

Activity Stream Options: Highlights

Activity Stream is a region on the Oracle Fusion Applications Welcomedashboard and other pages in various applications. Users track the activities andtransactions of other users in this region. You can set options that affect the allActivity Stream regions for all users across your site. Individual users can stilloverride your settings through Activity Stream preferences.

Activity stream settings are described in the Oracle Fusion Middleware User'sGuide for Oracle WebCenter Portal: Spaces. When you read content from thatguide, note that:

• Your setup applies to all users, not just yourself or any individual user.

• You can disregard discussions about how to access the settings, becauseyou access the Set Activity Stream Options page by starting in the Setupand Maintenance Overview page and searching for the Set ActivityStream Options task.

Setting Activity Stream Options

• Define the types of users to display activities about in the Activity Streamregion, the types of activities to track, and other settings.

See: Setting Activity Stream Preferences

Manage Menu Customizations

Design Time Menu Customizations: Highlights

The menu customization feature provides several options to add, modify, andorganize the Navigator and home page menus during design time. You musthave developer rights to perform these customizations.

Note


Design time menu customizations are not applicable to Oracle Cloudimplementations.

An overview of customizing the Navigator menu and home page is provided inthe Oracle Fusion Applications Extensibility Guide.

Customizations

• Use Oracle JDeveloper to customize the Navigator and home page menusat design time.

See: Customizing Menus

• Define translations for your customizations in the locales you support.

See: Translating Menu Customizations

• Customize the page template to display the Navigator menu groups asseparate menus, each of them displaying their list of menu items. Refer tothe Oracle Fusion Applications Developer's Guide.

See: Rendering the Navigator Menu as Dropdown Buttons

Manage Audit Policies

Managing Audit Policies: Explained

Auditing is used to monitor user activity and all configuration, security, and datachanges that have been made to an application. Auditing involves recordingand retrieving information pertaining to the creation, modification, and removalof business objects. All actions performed on the business objects and themodified values are also recorded. The audit information is stored without anyintervention of the user or any explicit user action.

Use audit policies to select specific business objects and attributes to be audited.The decision to create policies usually depends on the type of information to beaudited and to the level of detail that is required to be reported.

Enabling Audit Functionality

To enable audit, ensure that you have administrative privileges. For OracleFusion Applications, you must configure the business objects and select theattributes before enabling audit. If you enable audit without configuring thebusiness objects, auditing remains inactive. By default, auditing is disabled forall applications.

To enable auditing for Oracle Fusion Middleware products, select one of thelevels at which auditing is required for that product. The audit levels arepredefined and contain the metadata and events to be audited. For moreinformation, refer to the Oracle Fusion Middleware documentation and alsothe Oracle Enterprise Repository for Oracle Fusion Applications at http://fusionappsoer.oracle.com.


If you do not want an application to be audited, you can stop the audit processby setting the Audit Level option to None. While viewing the audit report forthat application, you can specify the period during which auditing remainedenabled.

Configuring Audit Business Object Attributes: Points to Consider

Audit allows you to track the change history of particular attributes of a businessobject. However, those objects and their attributes must be selected for auditand auditing must be enabled for that application. Your configuration settingsdetermine which attributes to audit for a given object, and when the audit startsand ends. Auditing takes into account all the create or insert, update, and deleteoperations performed on an object and its attributes.

To configure audit business object attributes, navigate to the Manage AuditPolicies page in the Setup and Maintenance work area.

Selecting an Application

To set up auditing, you must select a web application that contains the requiredbusiness objects that can be audited. From the list of business objects, select thosebusiness object that you want to audit. Selecting a business object also displaysits attributes that are enabled for auditing.

Selecting Attributes

For each selected business object to be audited, select the correspondingattributes to include in the audit. All attributes that belong to that object are bydefault selected for audit and appear on the user interface. However, you canadd or remove attributes from the list. When you remove an attribute from thelist, you stop auditing it even when the parent object is selected for audit. So, ifyou want an attribute to be audited, you must add it to the list.

Note

If the object selected in an audit hierarchy is also a part of several other audithierarchies, the attribute configuration for that object is applicable to all thehierarchies in that application.

Starting and Stopping Audit

The business object is ready for audit after you select its attributes and save theconfiguration changes. However, to start auditing, the audit level for OracleFusion Applications must be set to Auditing on the Manage Audit Policies page.

To stop auditing an object, you can deselect the entire object and save theconfiguration. As a result, all its selected attributes are automatically deselectedand are not audited. To continue to audit the business object with selectattributes, deselect those attributes that are not to be audited.


When end-users view the audit history for an application, they can specify theperiod for which they want the results. Therefore, it is important to note whenyou start and stop auditing an application. For example, today if end-usersintend to view the audit history of an object for the previous week, but auditingfor that object was stopped last month, they would not get any audit results forthat week because during the entire month that object was not audited. Even ifyou enable audit for that object today, end-users cannot get the wanted resultsbecause audit data until today is not available.

Configuring Audit: Highlights

You can set up auditing for Oracle Fusion Applications using the ManageAudit Policies page in the Setup and Maintenance work area of Oracle FusionApplications.

To set up auditing for Oracle Fusion Middleware products, you must select thelevel of auditing that maps to a predefined set of metadata and events that haveto be audited. Information on configuring audit for Oracle Fusion Middlewareproducts is provided in Oracle Fusion Middleware guides.

You can also create a configuration file and deploy it to audit a specific OracleFusion Middleware product. The configuration details for Oracle FusionMiddleware products are available in the form of audit-specific assets that canbe used to create the configuration file (config.xml). For more information, seethe Oracle Enterprise Repository for Oracle Fusion Applications at http://fusionappsoer.oracle.com, and search with Audit as the Asset Type to get the listof audit-specific assets.

Oracle Fusion Middleware Products

• Configure business objects to enable auditing in Oracle FusionMiddleware products. Refer to the Oracle Fusion Middleware Securityand Administrator's Guide for Web Services.

See: Auditing Web Services

Oracle Fusion Security Products

• Configure business objects to enable auditing in Oracle Fusion securityproducts. Refer to Oracle Fusion Middleware Application Security Guide.

See: Oracle Fusion Middleware Audit Framework Reference

Manage Oracle Social Network Objects

Managing Oracle Social Network Objects: Explained

Use the Manage Oracle Social Network Objects task for managing the OracleSocial Network Objects. The integration of Oracle Social Network Cloud


Service with applications and business processes brings key attributes from theapplications to share, socialize, and update information. This helps in makingbetter business decisions based on additional information that you obtain andanalyze within your social network environment.

Use the Manage Oracle Social Network Objects page to set up and define:

• The business objects and attributes to enable

• The enablement method for social network integration with Oracle FusionApplications

You can access the Manage Oracle Social Network Objects page by starting inthe Setup and Maintenance Overview page and searching for the task namedManage Oracle Social Network Objects.

Use social network to:

• Discuss projects and plans in public forums

• Maintain:

• Membership groups

• Activity feeds of the people you choose

• Facilitate:

• One-on-one Conversations

• Reviews

• Document sharing

Note

Oracle Social Network Cloud Service is currently available in Cloudimplementations only.

An important aspect of managing Oracle Social Network objects is enablingbusiness objects for integration.

Enabling Business Objects for Integration

A business object can't be shared within social network until a functionaladministrator or implementor:

• Accesses the Manage Oracle Social Network Objects page in OracleFusion Applications

• Enables the business object for social network integration

Options for Enabling Oracle Social Network Objects: Explained

To enable business objects and apply attributes for Oracle Social Network CloudService integration with Oracle Fusion Applications, use the Manage OracleSocial Network Objects task.


In the Manage Oracle Social Network Objects page, you can:

• Enable an object

• Disable an object

• Enable all objects

• Enable business object attributes

To access the Manage Oracle Social Network Objects page:

1. Search for the Manage Oracle Social Network Objects task in the Setupand Maintenance work area.

2. In the Search Results section, click the Go to Task icon to open theManage Oracle Social Network Objects page.

Note

Custom objects and attributes created in CRM Composer in the mainline are alsodisplayed on the Manage Oracle Social Network Objects page. You can enablethese objects and attributes for social network integration.

Enable Object

To enable a business object:

1. Access the Manage Oracle Social Network Objects page.

2. In the Business Objects section, select a business object, click EnableObject, and select one of the enablement options. The availableenablement options are:

• Manual: (Recommended) Empowers the user to decide whether toshare each instance of the object with social network.

Note

Once shared, all updates to the enabled attributes of the object instance, anddeletes, are sent to social network. Updates to attributes that are not enabled arenot sent.

• Automatic: Automatically sends the newly enabled object instancesand updates to social network.

Note

All object instances are automatically shared with social network upon creation,and all subsequent updates to the enabled attributes of the object instances, anddeletes, are automatically sent to social network.

• No: Does not send any information on object instance to socialnetwork. This is the default option.

3. Click OK.


This enables the selected business object, and empowers the user to decidewhether to share each instance of the object with social network.

Note

After you enable an object, you must enable one or more attributes in theAttributes section of the Manage Oracle Social Network Objects page. Updatesto enabled attributes are sent to social network.

Disable Object

To disable a business object:


2. In the Business Objects section, select a business object, and click DisableObject.

3. Save your changes.

This disables the selected business object by updating the enablement option asNo.

Enable All

To enable all business objects:


2. In the Business Objects section, click Enable All.


This enables all business objects in bulk, and updates the enablement option ofall business objects as Manual.

Note

• After you enable business objects, you must enable one or more attributesin the Attributes section of the Manage Oracle Social Network Objectspage. Updates to the enabled attributes are sent to social network.

• If you enable a business object, but don't configure any attributes for theenabled business object, no attributes are sent to social network duringcreate and update. The only exception is that some internal bookkeepinginformation are sent. Deletes are sent as usual.

Status Column

The Status column in the Business Objects table visually indicates:

• Whether a business object is enabled

• Which enabled business objects don't yet have an enabled attributeassigned

The status indicators include:

• A check mark, which indicates that you have configured attributes for anenabled business object


• A warning sign, which indicates that you have not configured anyattributes for an enabled business object

Enable Business Object Attributes

To enable business object attributes:

1. In the Attributes section, click Add to display the Select Attributes dialogwhere you can select attributes to add to the table.

2. Select an attribute name in the table, and select the Enabled check box toenable the attribute.

3. Click OK.


In the Attributes table, you can also:

• Click View to view a list of all attributes that are enabled.

• Click Remove to remove attributes from the table.

• Hover over the Attribute Information icon displayed next to descriptiveflexfield attributes to view information about the attributes.

Update Translations: Explained

The Update Translations process sends attribute labels and business objectnames to Oracle Social Network Cloud Service for use in the user interface.

In social network, the attribute or business object labels appear in the languageof your locale. If you change the locale in social network, then the attributeor business object labels appear in the updated language. However, the dataappears in the language in which it was originally sent to social network. If youhave previously sent an instance of the business object to social network, thenthe instance data isn't updated. Clicking the Update Translations button on theManage Oracle Social Network Objects page sends translations for businessobjects with the enablement option as Manual or Automatic.

Synchronize Business Objects: Explained

Use the Synchronize button on the Manage Oracle Social Network Objectspage to synchronize business objects. This re-sends the definitions of businessobjects having the enablement option as Manual or Automatic to Oracle SocialNetwork Cloud Service.

Use the Synchronize button at the:

• Business Objects table level: To re-send the definitions of a selectedbusiness object to social network. This button is enabled only when youselect a row for a business object with the enablement option as Manualor Automatic.


• Manage Oracle Social Network Objects page level: To re-send thedefinitions of all business objects with the enablement option as Manualor Automatic to social network.

Note

If you had modified any business object enabled for social network and notsaved your changes, then on clicking the Synchronize button, a warningmessage appears. This message informs you that you have not saved yourchanges, and you can select one of the following options:

• Save and Synchronize: To save the modified business objects, andsynchronize the unmodified business objects.

• Synchronize: To ignore any unsaved business objects, and onlysynchronize the unmodified business objects.

• Cancel: To cancel the synchronization task.

FAQs for Manage Oracle Social Network Objects

What happens if I update translations?

When you update translations, you send translations for business objects withthe enablement option as Manual or Automatic to Oracle Social Network CloudService.

On updating translations, you also:

• Synchronize the newly translated text from Oracle Fusion Applications sothat it can be used within social network. This means you can:

• Install and enable a new language.

• Take a language patch at any time.

• Send attribute labels and business object names to social network for usein its user interface.

How can I update translations?

Use the Update Translations button on the Manage Oracle Social NetworkObjects page for subsequent updates to labels and attributes.

Use the Update Translations button at the:

• Business Objects table level: To send translations for a selected businessobject to Oracle Social Network Cloud Service. This button is enabled onlywhen you select a row for a business object with the enablement option asManual or Automatic.

• Manage Oracle Social Network Objects page level: To send translationsfor all business objects with the enablement option as Manual orAutomatic to social network.


Note

When you save the enablement of a business object to social network, it sendsthe translations as well. Hence, you need not click the Update Translationsbutton after saving the enablement.

When do I update translations?

Run the Update Translations process only after you install a new language packof Oracle Fusion Applications.

Updating translations synchronizes the newly translated text to Oracle SocialNetwork Cloud Service for integration with Oracle Fusion Applications.

Note

When you save the enablement of a business object to social network, it sendsthe translations as well. Hence, you need not click the Update Translationsbutton after saving the enablement.

What happens if I synchronize business objects?

When you synchronize business objects, you re-send the definitions of businessobjects having the enablement option as Manual or Automatic to Oracle SocialNetwork Cloud Service.

When do I synchronize business objects?

Run the Synchronize process after the import of Customization Set Migration(CSM).

You can also run the process any time you want to synchronize the settings ofbusiness objects with Oracle Social Network Cloud Service without making anychanges in the Manage Oracle Social Network objects page.

Manage Applications Core Common Reference Objects

Manage Applications Core Messages

Common Messages: Points to Consider

Common messages, which have message names that begin with FND_CMNand message numbers between 0 and 999, are used throughout Oracle FusionApplications. Each common message can appear in multiple places in anyproduct family. For example, the FND_CMN_NEW_SRCH message can be used


for any search to indicate that no results were found. Common messages that areof type error or warning are part of the message dictionary.

Editing Common Messages

Because a common message can be used in any application, consider theramifications if you edit any aspect of the message, including incident andlogging settings. Changes would be reflected in all instances where the messageis used. For example, if you change the message text, make sure that the textwould make sense to all users across Oracle Fusion Applications who might seeit.

Creating Common Messages

You can create custom common messages for use in multiple places withina single product. Do not begin the message name with FND_CMN, but useanother suitable convention. The message number should be within the rangethat is designated for the product.

Manage Applications Core Administrator Profile Values

Each message in the message dictionary has many attributes and components,including message properties, text, and tokens, that you define when creatingor editing the message. To create or edit a message, navigate to the ManageMessages page in the Setup and Maintenance work area.

Details about these messages are described in the Oracle Fusion ApplicationsDeveloper's Guide.

Message Properties

• The message type identifies the type of information that the messagecontains.

See: Understanding Message Types

• The message name and number are identifiers for the message. Thereare specific message number ranges for predefined messages in eachapplication, and you should not edit numbers assigned to predefinedmessages. When creating custom messages, use only message numberswithin the 10,000,000 to 10,999,999 range.

See: About Message Names

See: About Message Numbers

• The translation notes for predefined messages might contain internalcontent that you can disregard.

See: About Translation Notes

• The message category, severity, and logging enabled option are related tothe incident and logging process.


See: About Grouping Messages by Category and Severity

See: Understanding Incidents and Diagnostic Logs with MessageDictionary

Message Text and Tokens

• The message text comprises various components, some of which aredisplayed only to select users. To determine which component of themessage text is displayed to a particular user, set the Message Modeprofile option (FND_MESSAGE_MODE) at the user level for that user.The message component short text is visible to all users and therefore, theprofile option does not apply to this component. Also, the profile optionapplies only to messages in the message dictionary.

See: About Message Components

• Tokens are variables that represent values to be displayed in the messagetext.

See: About Tokens

Profile Options and Related General Preferences: How They Work Together

Some Oracle Middleware Extensions for Applications profile options are relatedto general preferences in the global area.

Preferences

The related general preferences are Default Application Language, Territory,Date Format, Time Format, Currency, and Time Zone. When the user changesany of these preferences, the stored values in LDAP are updated accordingly.

Profile Options

The corresponding profile options are Default Language, Default Territory,Default Date Format, Default Time Format, Default Currency, and Default UserTime Zone. No matter what you set for these profile options at any level, thepreferences settings, or LDAP values, take precedence. The profile option valueis used only if the LDAP value is not available. Updating the profile option valuedoes not automatically update the value in LDAP or preferences.

Define WebLogic Communication Services Configuration 9-1

9Define WebLogic Communication

Services Configuration

Click-to-Dial: Explained

Use Click-to-Dial to place a call to a contact from a hyperlink on the phonenumber or phone icon.

Here are a few topics that are important to know when using Click-to-Dial:

• Normal call flow

• Interaction Records and Notes

• Operational Notes

Note

Click-to-Dial must be enabled to make calls using the various contactinformation pages and pop-up UIs. When enabled, phone numbers appearas hyperlinks. Interaction logging is available if that feature is enabled. Ifinteraction logging is available, a note indicating that fact will be displayed inthe UI. See Click to Dial: Top Tasks for more information about enabling thesefeatures.

Normal Call Flow

Click-to-Dial uses a call-the-caller-then-call-the-callee procedure for completinga phone call. That format and the normal flow of this procedure are describedbelow.

• You initiate a call

If you see a small orange square next to a contact or customer name, clickthe square to display further details, including phone numbers. To place acall, place your mouse over the phone number hyperlink and click.

Note

Click-to-Dial does not work on phone numbers that are marked with a Do NotCall icon.

• Select a Calling Phone


Choose the calling phone number. Usually the calling phone is a numberfrom your profile information. Alternately, if you need to use a phone notin your profile, you can specify a different number to originate your call.

• Call Flow

After you select the calling phone number, the system calls you back onthat number, waits for you to answer, and then calls the person for whomthe call is intended.

Interaction Records and Notes

Click-to-Dial automatically creates an interaction record of the call, when thatfeature is enabled. The details window that provides the phone number may alsoshow an Interaction icon that you can click to display a list of interaction recordsto edit, for example to provide a description of the call. The window may alsoprovide a notes feature that you can use to record notes during the call.

Interaction Logging

The interaction record is logged as soon as the call is either successfully set up orknown to have failed.

The interaction log records the customer, call participants, a timestamp notingthe start time of the call, the direction of the communication, in or outbound, and


the resolution code. The description is automatically updated with these threeitems:

• Call ID from OWLCS

• Your chosen phone number

• Contact phone number

The call resolution code is determined from OWLCS and recorded in theinteraction:

OWLCS Call Status Resolution Code in Interaction

CallConnected CALL ANSWERED

CallAborted FAILED

CallHangUp FAILED

CalledPartyBusy NOT AVAILABLE

CalledPartyNoAnswer NOT AVAILABLE

CalledPartyNotReachable NOT AVAILABLE

CallingPartyBusy FAILED

CallingPartyNoAnswer FAILED

CallingPartyNotReachable FAILED

Editing interactions

Once the call is established, if Interactions is available, you can use theInteractions icon on the UI to launch the interaction record list view. Select thecurrent interaction record to edit it.

Operational Notes

Because of the call-the-caller-then-call-the-callee format, there are someconditions that may occur due to several calling situations. Some of theseconditions are described below:

• Why don't I hear a ring-back tone? As soon as you answer the system call-back, the system immediately dials the contact. You won't hear a ring-back tone as in a normal outbound phone call. However, you can tell thatthe call attempt is progressing because:

• The phone indicates that the connection is active. If the call to thecontact reaches a busy tone or the call attempt times out, the connectionis dropped.

• The dialing window stays on the screen while the call attempt isprogressing. It disappears when the connection is either successfullyestablished or fails.

• What if your phone is busy and the call-back goes directly to voice mail?Normally this would not happen because you would not initiate a newcall when you are already busy on another call. However, this situationcould occur due to a race condition, that is where another incoming callreaches your phone before the Click-to-Dial call-back. When this happens,two different scenarios could occur:


• If your phone is configured for busy-forward-all-to-voice-mail, theClick-to-Dial call would be forwarded to your voice mail, and thesystem thinks that the caller has answered the call and will proceedto call the contact. On answering, the contact hears your voice-mailgreeting.

• If your phone is capable of presenting a second call to the user, as issupported by many office phones and mobile phones, then you can stillanswer the Click-to-Dial call and there is no issue.

• What if you wait too long to answer the call-back? In other words, youwait longer than the ring-no-answer-forward-to-voice-mail timer on thephone system and the call goes to voice mail. Normally, this would nothappen because you are expecting the inbound call after you started thecall, and would answer promptly. However, if for some reason you donot answer and allow the call to ring-no-answer-forward to voice mail,then the system would think that you have answered the call and willproceed to call the contact. On answering, the contact hears your voice-mail greeting.

• What if the contact does not answer in 30 seconds and the systemabandons the call attempt? If the contact's voice mail is configured toanswer after 30 seconds, you will not be able to leave a message.

Click-to-Dial: Top Tasks

Click-to-Dial is a feature of the customer contact process. Phone communicationto customers and employees is initiated with a click of the mouse, leveragingyour customer contact information and the application context. The Click-to-Dial feature uses Oracle WebLogic Communication Services, OWLCS, to enablecommunications. Applications that provide the Click-to-Dial functionality do soprimarily through contextual actions in the application.

Additionally, Click-to-Dial utilizes Oracle Fusion Interactions as an optionaltransaction logging feature that will track information about the call such asthe customer, call participants, a timestamp noting the start time of the call, thedirection of the communication, in or outbound, and the resolution code.

Click-to-Dial integrates with your telephony environment and must be manuallyenabled in your deployment. This topic highlights what is required to set up theClick-to-Dial feature and to implement logging of the calls made using the Click-to-Dial feature.

Terms used in setting up these communications

• PSTN: Public switched telephone network is the network of the world'spublic circuit-switched telephone networks.

• SIP: Session initiation protocol, an open signaling protocol standard that isused to set up phone calls

• TPCC: Third Party Call Control enables an application to control thetelephony network to set up calls automatically.

• OWLCS: Oracle WebLogic Communication Services. Offers the TPCCservice to Fusion applications and sets up the calls via SIP integrationwith the telephony network.


The set up task list Define WebLogic Communication Services Configurationdelineates four tasks required for the correct configuration and implementationof Click-to-Dial. There is an optional task, separate from the set up task list,required for implementing Interaction logging.

Information about implementing Click-to-Dial can be found in the Oracle FusionApplications Administrator's Guide. Detailed information about configuring andmaintaining WebLogic Communication Services is found in the Oracle WebLogicCommunication Services Administrator's Guide

Configure and Deploy WebLogic Server

• Deploy WebLogic Communication Services: After the Oracle WebLogiccommunication server is deployed, this manual task activates the server.

See: Oracle WebLogic Communication Services Administrator's Guide

Integrate Communications Services

• Integrate WebLogic Communication Services with Telephony Network:This manual task integrates communications within the telephonyenvironment. OWLCS must be configured to interface with the specificcharacteristics of the telephony network.

See: Managing Oracle WebLogic Communication Services for Click-to-Dial Functionality

Specify the Domain and Address

• Register a URL for the telephony gateway or soft switch for SIP domain:This task defines the Server protocol, defaulted to http, the external serverhost address and external server port address. The Associated Modulessection is not required for setup. You can also perform this as a manualtask using the Oracle Fusion Topology Manager to configure the addressof the SIP Public Switched Telephone Network (PSTN) gateway or SIPsoft switch serving the users within that domain. This address is neededby Click-to-Dial to correctly form the SIP addresses required by WebLogicCommunication Services. See the link to Configuring PSTN GatewayAddress Using Topology Manager: Worked Example.

Enable Click-to-Dial

• After configuring the server and defining the SIP domain, perform theEnable Click-to-Dial task. This task sets the value of the profile optionEnable Click-to-Dial to 'Yes.'

Call Logging via Fusion Interactions

• To initiate the Interaction based logging for Click-to-Dial, set the profileoption Call Interaction Logging Enabled to 'YES.'

Configuring PSTN Gateway Address Using Topology Manager:

Worked Example

This example demonstrates how, during the implementation of the RegisterURL for the telephony gateway or soft switch for SIP domain task,


you must manually configure the PSTN gateway address by registeringHzCTDPstnGatewayApp to a given environment using Oracle Fusion TopologyRegistration

These steps configure the address of the SIP Public Switched Telephone Network(PSTN) gateway or SIP soft switch serving the users within that domain. Thisaddress is needed by Click-to-Dial to correctly form the SIP addresses requiredby WebLogic Communication Services.

For example: SIP:+1650-555-1212@pstn_gateway.oracle.com;user=phone wherepstn_gateway.oracle.com is the SIP domain. The SIP domain can also beexpressed in the format 10.1.1.1 (IP address).

Configuring PSTN using the Topology Manager

1. Sign in to Oracle Fusion Applications as a user that has applicationimplementation consultant and WebLogic Services administration roles

2. In Fusion Applications Setup and Maintenance, click Register EnterpriseApplications from the regional area under Topology Registration

3. On the Register Enterprise Applications page, click the plus icon to add anenterprise application. An Add Enterprise Application popup appears

4. Enter the new application information: Click Search in the EnterpriseApplication list field. Enter HzCTDPstnGatewayApp in the name fieldand click Search. Click OK.

5. Enter the other fields in the Add Enterprise Application popup

Field Value

Name HzCTDPstnGatewayApp

Server Protocol SIP

This field is ignored by click-to-dial.

Oracle WebLogic Communication

Service (OWLCS) always uses the SIP

protocol.

External Server Host 10.143.167.91 (Used as an example)

A host name can be used instead of an

IP address.

External Server Port 0 (Used as an example)

This field is ignored by Click-to-Dial.

6. Click Save and Close

Define Applications Core Configuration 10-1

10Define Applications Core Configuration

Define Lookups

Lookups: Explained

Lookups are lists of values in applications. You define a list of values as a lookuptype consisting of a set of lookup codes, each code's translated meaning, andoptionally a tag. End users see the list of translated meanings as the availablevalues for an object.

Lookups provide a means of validation and lists of values where valid valuesappear on a list with no duplicate values. For example, an application mightstore the values Y and N in a column in a table, but when displaying thosevalues in the user interface, Yes or No (or their translated equivalents) should beavailable for end users to select. For example, the two lookup codes Y and N aredefined in the REQUIRED_INDICATOR lookup type.

In another example, a lookup type for marital status has lookup codes for usersto specify married, single, or available legal partnerships.

Lookup Type Lookup Code Meaning Tag

MAR_STATUS M Married

S Single

R Registered Partner +NL

DP Domestic Partner -FR, AU

In this case, tags are used for localizing the codes. All legislations list Marriedand Single. Only the Dutch legislation lists Registered Partner. And alllegislations except France and Australia also list Domestic Partner.

When managing lookups, you need to understand the following.

• Using lookups in applications

• Customization levels

• Accessing lookups

• Enabling lookups


• The three kinds of lookups: standard, common, and set enabled

Using Lookups in Applications

Use lookups to provide validation or a list of values for a user input field in auser interface.

An example of a lookup used for validation is a flexfield segment using atable-validated value set with values from a lookup type. An example of alookup in a list of values is a profile option's available values from which usersselect one to set the profile option. Invoice Approval Status gives the option ofincluding payables invoices of different approval statuses in a report. The lookupcode values include All so that users can report by all statuses: Approved,Resubmitted for approval, Pending or rejected, and Rejected.

Customization Level

The customization level of a lookup type determines whether the lookups in thatlookup type can be edited. This applies data security to lookups.

Some lookup types are locked so no new codes and other changes can be addedduring implementation or later, as needed. Depending on the customizationlevel of a lookup type, you may be able to change the codes or their meanings.Some lookups are designated as extensible, so new lookup codes can be createdduring implementation, but the meanings of predefined lookup codes cannot bemodified. Some predefined lookup codes can be changed during implementationor later, as needed.

The customization levels are user, extensible, and system. The following tableshows which lookup management tasks are allowed at each customization level.

Allowed Task User Extensible System

Deleting a lookup type Yes No No

Inserting new codes Yes Yes No

Updating start date, enddate, and enabled fields

Yes Yes, only if the code isnot predefined data

No

Deleting codes Yes Yes, only if the code isnot predefined data

No

Updating tags Yes No No

Updating module Yes No No

Predefined data means LAST_UPDATED_BY =SEED_DATA_FROM_APPLICATION.

If a product depends on a lookup, the customization level should be system orextensible to prevent deletion.

Once the customization level is set for a lookup type, it cannot be modified. Thecustomization level for lookup types created using the Define Lookups page isby default set at the User level.

Standard, Common, and Set-Enabled Lookups

The available kinds of lookups are as follows.


Lookup Description

Standard Lists the available codes and translated meanings

Set enabled Additionally associates a reference data set with thelookup codes

Common Legacy lookups

Standard lookups are the simplest form of lookup types consisting only of codesand their translated meaning. They differ from common lookups only in beingdefined in the standard lookup view.

Common lookups exist for reasons of backward compatibility and differ fromstandard lookups only in being defined in the common lookup view.

Set enabled lookup types store lookup codes that are enabled for reference datasharing. At runtime, a set-enabled lookup code is visible because the value of thedeterminant identifies a reference data set in which the lookup code is present.

Accessing Lookups

Standard, set-enabled, and common lookups are defined in the Standard, Set-enabled, and Common views, respectively. Applications development maydefine lookups in an application view to restrict the UI pages where they mayappear.

In lookups management tasks, lookups may be associated with a module in theapplication taxonomy to provide a criteria for narrowing a search or limitingthe number of lookups accessed by a product specific task such as ManagePurchasing Lookups.

Enabling Lookups

A lookup type is reusable for attributes stored in multiple tables.

Enable lookups based on the following.

• Selecting an Enabled check box

• Specifying an enabled start date, end date, or both

• Specifying a reference data set determinant

If you make changes to a lookup, users must sign out and back in before thechanges take effect. When defining a list of values for display rather thanvalidation, limit the number of enabled lookup codes to a usable length.

For more information on the predefined lookups and lookup codes, see assetswith the Lookup type in the Oracle Enterprise Repository for Oracle FusionApplications (http://fusionappsoer.oracle.com).

Managing a Standard Lookup: Example

Creating a new standard lookup involves creating or selecting a lookup typeto which the lookup code belongs, and determining appropriate values for thelookup codes and their meanings.


Note

You can only create or edit the lookup codes for a particular lookup type if itscustomization level supports it.

Creating a Lookup Type Called COLORS

Your enterprise needs a list of values for status to be used on various objects suchas processes or users. The lookups are colors, so the lookup type you create isCOLORS.

Lookup type parameters Value

Lookup type name COLORS

Meaning Status

Description Status by color

Module Oracle Middleware Extensions for Applications

The lookup codes you define for the COLORS lookup type are, BLUE, RED,GREEN, and YELLOW.

Lookup Code Meaning Enabled Display Sequence

BLUE Urgent No 4

RED Stop Yes 1

GREEN Go Yes 3

YELLOW Caution Yes 2

Understanding the Resulting Data Entry List of Values

Users need to respond to a process question by indicating whether to stop it, usecaution, go ahead, or complete it urgently.

The list of values for the COLORS lookup type includes the meanings for theenabled codes.

Displayed Value Hidden ID

Stop RED

Caution YELLOW

Go GREEN

Analysis

The BLUE lookup code was not enabled and does not appear in the list of values.The display sequence of values in the list of values is alphabetical unless youenter a number manually to determine the order of appearance. Number 1indicates the value listed first in the list of values.

Note

Only lookups that are enabled and active, meaning between start and end dates,are visible.


Understanding the Transaction Table

When users enter one of the values from the list of values for the lookup typeCOLORS, the transaction table records the lookup code. In this example, thecode is stored in the Status column

Transaction number User name Status

1 Jane RED

2 Bob YELLOW

3 Alice BLUE

The status for one user is BLUE because at the time they entered a value, BLUEwas enabled. Disabling a lookup code does not affect transaction records inwhich that code is stored. Data querying and reporting have access to disabledlookup codes in transaction tables.

Managing Set-Enabled Lookups: Examples

Creating a new set-enabled lookup is similar to creating a standard lookup withthe addition of specifying a reference data set determinant for the lookup codes.

Note

You can only create or edit the lookup codes for a particular lookup type if itscustomization level supports it.

The reference data set for a set-enabled lookup code is part of its foreign key.This is unlike other set-enabled entities.

Selecting a Reference Group for a Set-Enabled Lookup Type

By specifying a reference group for a set-enabled lookup type you indicate whichreference data set assignments are available for its lookup codes. For example aCOLORS lookup type might be set enabled for a Countries reference group thatincludes the US and EU reference data set assignments.

Selecting a Reference Data Set for a Set-Enabled Lookup

The reference data set determines which lookup code is included in the list ofvalues. If a COLORS lookup type contains a RED, YELLOW, ORANGE, andGREEN lookup code, you can enable one RED lookup as coming from the USreference data set and another RED lookup as coming from the EU reference dataset with divergent meanings.

Reference Data Set Lookup Code Lookup Meaning

US RED Red

US YELLOW Yellow

US GREEN Green

EU RED Rouge

EU ORANGE Orange


In addition to divergent meanings for lookup codes based on associatedreference data set, some lookup codes may be unique to one or another referencedata set as the ORANGE lookup is to the EU reference data set in this example.

In another example, a lookup type called HOLD_REASON provides a list ofreasons for applying a hold to a contract renewal. Reference data sets determinewhich codes are included in the hold reason list of values.

Reference Data Set Lookup Code Lookup Meaning

US SEC SEC Compliance Review

US DIR Needs Director's Approval

US VP Needs Vice President's Approval

CHINA CSRC Pending China SecuritiesRegulatory Commission Review

CHINA PR Needs President's Approval

COMMON REQUESTED Customer Request

Using the Manage Set Assignments task, you have defined assignments thatdesignate the China business unit to refer to the CHINA and the US businessunit to refer to the US and all business units to refer to the COMMON set.When end users place a contract hold in the US business unit, only the threereason codes in US_SET are available. When placing a contract hold in the Chinabusiness, only the two codes in China_SET are available.

FAQs for Define Lookups

How can I edit lookups?

You can edit the existing lookup codesof a lookup type or add new lookup codeson the Define Lookups pages, which you can access by starting in the Setup andMaintenance work area and searching for lookup tasks. You can edit the existinglookup codes of a lookup type, or add new lookup codes to a lookup type, if thecustomization level for the lookup type supports editing

Why can't I see my lookup types?

Lookups are listed by lookup type. Typically lookup types are managed usingtasks that handle a group of related lookups, such as Manage GeographyLookups. Each task gives you access only to certain lookup types. The generictasks provide access to all lookups types of a kind, such as all common lookupsusing the Manage Common Lookups task.

If existing lookups are not available to the tasks of the Define Lookups activity,they may be validated for use in a lookup view that is not central to allapplications or whose owning application has not been specified in a lookupview.

Lookups can only be managed in the Define Lookups tasks if the lookup's viewapplication is the standard lookups view, common lookups view, or set-enabled


lookups view. Lookups defined in an application view can only be managed byfollowing instructions provided by the owning application.

Note

A lookup type and its codes can only be defined in one lookup view.

What's the difference between a lookup type and a value set?

A lookup type consists of lookup codes that are the values in a static list ofvalues. Lookup code validation is a one to one match.

A table-validated value set can consist of values that are validated through aSQL statement, which allows the list of values to be dynamic.

Tip

A table validated value set can be defined based on any table, including thelookups table. This allows a lookup type to be made into a table-validated valueset that can be used in flexfields.

Area of Difference Lookup Type Value Set

List of values Static Dynamic if Table validation type

Validation of values One to one match of meaning tocode included in a lookup view,or through the determinant of areference data set

By format or inclusion in a table

Format type of values char varchar2, number, and so on

Length of value Text string up to 30 characters Any type of variable length from 1to 4000

Duplication of values Never. Values are unique. Duplicate values allowed

Management Managed by both administratorsand end-users, except systemlookups or predefined lookups atthe system customization level,which cannot be modified.

Maintained by administrators,except some product flexfieldcodes, such as GL for OracleFusion General Ledger, which aremaintained by end users

A lookup type cannot make use of a value from a value set.

Value sets can make use of standard, common, or set-enabled lookups.

Both lookup types and value sets are used to create lists of values from whichusers select values.

What's a lookup tag used for?

Tags on lookup codes allow you to add a label to your lookup codes.


Lookup tags are unvalidated and uninterpreted by lookups. A tag can be usedto categorize lookups based on facilitating searches or guiding how a lookupshould be used.

Document what the tag on a lookup represents and how to use it.

Manage Messages

Messages: Highlights

The message dictionary contains messages that tell users about business ruleerrors, such as missing or incorrect data, and how to resolve them, to warn usersabout the consequences of intended actions, and provide information in log files.These messages are defined for specific applications and modules, but a few arecommon messages that can be used in any application. All applications also usemessages stored outside of the message dictionary.

The message dictionary is described in the Oracle Fusion ApplicationsDeveloper's Guide.

Managing Messages

• Use the Manage Messages page to create and edit custom messages in themessage dictionary, as well as edit predefined messages. Do not deletepredefined messages unless you are sure that they are not used anywhere.Refer to the Oracle Fusion Applications Developer's Guide.

See: Introduction to Message Dictionary Messages

• Messages outside of the message dictionary, such as confirmationsand field validations, are managed either in the Oracle ApplicationDevelopment Framework or through message resource bundles used fortranslation.

Creating and Editing Messages: Highlights

Each message in the message dictionary has many attributes and components,including message properties, text, and tokens, that you define when creatingor editing the message. To create or edit a message, navigate to the ManageMessages page in the Setup and Maintenance work area.

Details about these messages are described in the Oracle Fusion ApplicationsDeveloper's Guide.

Message Properties

• The message type identifies the type of information that the messagecontains.

See: Understanding Message Types

• The message name and number are identifiers for the message. Thereare specific message number ranges for predefined messages in each


application, and you should not edit numbers assigned to predefinedmessages. When creating custom messages, use only message numberswithin the 10,000,000 to 10,999,999 range.

See: About Message Names

See: About Message Numbers

• The translation notes for predefined messages might contain internalcontent that you can disregard.

See: About Translation Notes

• The message category, severity, and logging enabled option are related tothe incident and logging process.

See: About Grouping Messages by Category and Severity

See: Understanding Incidents and Diagnostic Logs with MessageDictionary

Message Text and Tokens

• The message text comprises various components, some of which aredisplayed only to select users. To determine which component of themessage text is displayed to a particular user, set the Message Modeprofile option (FND_MESSAGE_MODE) at the user level for that user.The message component short text is visible to all users and therefore, theprofile option does not apply to this component. Also, the profile optionapplies only to messages in the message dictionary.

See: About Message Components

• Tokens are variables that represent values to be displayed in the messagetext.

See: About Tokens

Common Messages: Points to Consider

Common messages, which have message names that begin with FND_CMNand message numbers between 0 and 999, are used throughout Oracle FusionApplications. Each common message can appear in multiple places in anyproduct family. For example, the FND_CMN_NEW_SRCH message can be usedfor any search to indicate that no results were found. Common messages that areof type error or warning are part of the message dictionary.

Editing Common Messages

Because a common message can be used in any application, consider theramifications if you edit any aspect of the message, including incident andlogging settings. Changes would be reflected in all instances where the messageis used. For example, if you change the message text, make sure that the textwould make sense to all users across Oracle Fusion Applications who might seeit.


Creating Common Messages

You can create custom common messages for use in multiple places withina single product. Do not begin the message name with FND_CMN, but useanother suitable convention. The message number should be within the rangethat is designated for the product.

Define Document Sequences

Document Sequences: Explained

In Oracle Fusion Applications, each business document or business eventis uniquely identified by a document sequence number that you assign toit. However, the document sequencing feature must be turned on (enabled)on the business document or event to allow the assignment. For example, ifdocument sequencing is enabled, you can assign a document sequence numberto an invoice that gets generated in response to a purchase order. You can usedocument sequences as a proof to track successfully executed transactionsas well as failed transactions. Additionally, a document sequence helps ingenerating an audit trail, which can be used to identify how a particulartransaction passed through various applications.

Document sequencing can be managed automatically, manually, and gaplessly.

Note

Plan your document sequencing carefully before you use the options availablein the application to apply sequence numbers. Avoid changes to the optionsafter you saved your work on the Manage Document Sequences and ManageDocument Sequence Categories pages.

Automatic Sequencing

Automatic document sequencing assigns a unique number to each documentas it is generated, and this unique number is stored in the database. Thenumbering is sequential by date and time of creation. If you define a sequence toautomatically number documents, you can provide an initial value to begin thesequence. In absence of a custom value, the default value 1 is used.

Manual Sequencing

Manual sequencing requires you to assign a unique number to each documentbefore it is generated. In manual sequencing, the numerical ordering andcompleteness of a transaction is not enforced. Users can skip or omit numberswhen entering the sequence value. However, each time that a number isassigned, the application validates its uniqueness.

Gapless Sequencing

Gapless sequencing is similar to automatic sequencing. It automaticallygenerates a unique number for each document, but does that only for


successfully generated documents. As a result, the sequence is maintained forall the documents that are generated, and no sequence numbers are lost due toincomplete or failed document generation.

Important

Use this type of sequencing only if necessary because it may affect theperformance of the system and slow down transaction processing.

Document Sequence Categories: Explained

A document sequence category is a set of documents that share similarcharacteristics and that are formed into a logical group. Document sequencecategories simplify the task of assigning number sequences to specificdocuments. Instead of assigning a number to each document, you assigna document sequence to one or more document sequence categories. Thedocument sequence category automatically takes care of numbering thedocuments.

A document sequence category identifies the database table that storesdocuments resulting from transactions that your users enter. When you assign asequence to a category, the sequence numbers the documents that are stored ina particular table. You must create document sequence categories to be able tomanage the task of assigning document sequences.

Restriction

Once a document sequence category is created, you cannot change theapplication, the category code, or the table name. Therefore, carefully considerthese details and plan your document sequencing requirement before you beginworking with the application.

Once you create a document sequence category, it is available for use underthe Document Sequences: Assignments section on the Manage DocumentSequences page. The Category field contains the name of the document sequencecategory. After you create a document sequence, you can assign it to a documentsequence category.

Document Sequences: Points to Consider

Sequencing documents is an important business and legal requirement. Certainaspects of the defining process are permanent and cannot be modified later.Therefore, it is important that you first decide the appropriate documentsequence to use for a set of documents. You must also decide beforehand thetype of document sequencing, because you are not allowed to switch to othertypes once a sequence is assigned to a document sequence category. Make anote of the details such as the document sequence and document sequencecategory so that you can refer to them at a later point in time. Also note if thereare any restrictions or configuration prerequisites before you define documentsequencing.


Note

Products that implement document sequencing have specifications about itsusage. Refer to the corresponding product documentation for specific details andalso to determine if there are any restrictions or configuration prerequisites.

Creating and Editing Document Sequences

You can create document sequences that are automatic, manual, or gapless,depending on the business or legal requirement. By default, the current dateis considered as the start date. If the end date is left blank, it means that thesequence definition never expires. Among the several options used in creatingand editing document sequences, the following options are functionally moreimportant and therefore need to be carefully determined:

• Determinant Type: Select to limit the document sequencing activity tocertain documents that belong to a specific business entity, such as Ledger,Tax Registration, and so on.

• Initial Value: Enter a value for the first document in your sequence. Thisfield applies only to sequences with automatic or gapless numberingtypes. Sequence numbers should not be greater than eight digits. If youleave this field blank, the first document is automatically assigned a valueof 1. Once a document sequence is defined, you cannot change this initialvalue.

Creating and Editing Document Sequence Categories

Document sequence categories are defined to make it easy to assign documentsequence definitions to a group of documents instead of to individualdocuments. Each document sequence category is mapped to a specific table,where the documents belonging to that category are stored. The table mustalready be enabled for document sequencing. When specifying the table, youmust consider the following points:

• When the sequential numbering feature checks for completeness orgenerates a report, it locates the category's documents in the table.

• You can select only tables belonging to the application associated with thecategory.

• Once a category is defined, you cannot change the choice of table.

Assigning Document Sequences

Identify the documents to be numbered before assigning them a documentsequence. For each document sequence, there can be only one active assignmentto a document sequence category, a method code, and a determinant value (ifapplicable). As part of the assignment, specify whether the document is createdautomatically (for example, due to a batch process, or manually through aform). If you do not specify an end date, the assignment continues to remainactive throughout the process cycle. If a determinant type was specified forthe document sequence, then enter a specific determinant value related to theselected determinant type.


At runtime, when users create documents, the document sequence to beassigned is determined by finding the active assignment that matches the correctcombination of category, numbering method, and the date range containing thetransaction date.

Auditing Document Sequences

You can audit document sequences, if required, to provide an audit trail of thedocument sequences used in a specific product. However, before enabling theaudit functionality for a document sequence, you must have created an audittable for the specific document sequence, using appropriate details. Enabling theaudit functionality is permitted only for newly created document sequences. Youcannot audit document sequences that are already in use by a specific product.

For more information about defining a document sequence audit table, see theOracle Fusion Applications Developer's Guide.

Define Trees

Trees: Overview

Use the tree management feature in Oracle Fusion applications to organize datainto hierarchies. A hierarchy contains organized data and enables the creationof groups and rollups of information that exist within an organization. Trees arehierarchical structures that enable several data management functions such asbetter access control, application of business rules at various levels of hierarchies,improved query performance, and so on.

For example, XYZ Corporation has two departments: Marketing and Finance.The Finance department has two functional divisions: Receivables and Payables.Defining a tree for the XYZ Corporation establishes a hierarchy between theorganization and its departments, and between the departments and theirrespective functional divisions. Such a hierarchical modeling of organizationaldata could be used for executing several data management functions within thatorganization.

You can create one or more versions of trees, and they can be labeled for betteraccessibility and information retrieval. You can create trees for multiple datasources, which allow the trees to be shared across Oracle Fusion applications.

Tree Structures

A tree structure is a representation of the data hierarchy, and guides the creationof a tree. A tree is an instance of the hierarchy as defined in the tree structure.Tree structures enable you to enforce business rules to which the data mustadhere.

The root node is the topmost node of a tree. Child nodes report to the root node.Child nodes at the same level, which report to a common parent node, are calledsiblings. Leaves are details branching off from a node but not extending furtherdown the tree hierarchy.


Tree Versions

A tree is created having only one version. However, users can create more thanone tree version depending on the need, and they can make changes to thoseversions. Depending on varying requirements, users can create one or more treeversions and publish all of them or some of them by making the versions activeat the same time. Similar to any other version control system, versions of treesare maintained to keep track of all the changes that a tree undergoes in its lifecycle.

Tree Labels

Tree labels are short names associated with trees and tree structures and pointdirectly to the data source. Tree labels are automatically assigned to the treenodes. You can store labels in any table and register the label data source withthe tree structure.

Manage Tree Structures

Tree Structures: Explained

A tree structure defines the hierarchy for creating trees and prescribes rulesbased on which trees are created, versioned, and accessed. You can associatemultiple data sources with a tree structure. A tree is an instance of this hierarchy.Every tree structure can contain one or more trees.

You can create tree structures specific to an application but you can share treestructures across applications. If you apply version control to the tree structure, itis carried over to the trees that are based on the tree structure. Each tree versioncontains at least one root node. Occasionally, a tree version may have more thanone root node.

An administrator controls the access to tree structures through a set of rules thatare periodically audited for validity.

Tree Structure Definition: Points to Consider

Defining a tree structure involves specifying several important pieces ofinformation on the Create Tree Structure: Specify Definition page.

Tree Node Selection

The Tree Node table displays data in nodes that exist in the data hierarchy.You must select the correct and most appropriate tree node table to be able todefine the tree structure, based on the tree hierarchy you want to establish. Thisselection also affects the level of security that is set on a tree node and its childentities.

Tree Sharing Mode

The following options are used to determine the mode of sharing a tree structureacross the applications.


• Open: Indicates that the tree is associated with all reference data sets.

• Set ID: Indicates that the tree will be associated with a specific referencedata set.

Creation Mode

Indicates the source where the tree structure is being defined. For predefined treestructures select Oracle and for custom structures, select Customers.

Customization

You can customize the predefined tree structures as well as the ones thatyou created. However, customizing the predefined tree structures involvescertain level of access restrictions, and will be limited to specific tree nodes anddownwards in hierarchy.

Multiple Tree Versions

One or more trees and tree versions can be based on a tree structure. A treestructure can have one or more trees and tree versions based on it. Usually, onlyone active version is permitted at any given point of time. However, dependingon the requirement, you can allow two or more tree versions to be in the activestate for the same date range. This flexibility allows you to choose the treeversion that you want to implement.

Managing Tree Structures: Points to Consider

You can create, edit, and delete tree structures depending upon the requirement.You can also audit and change the status a tree structure.

Creating and Editing Tree Structures

You can create trees on the basis of a tree structure. When you edit an activetree structure, the status of the tree structure and all associated trees and theirversions change to draft. To reuse a tree structure, you can create a copy ofit without copying the associated trees and tree versions. If you delete a treestructure, all the associated trees and tree versions are automatically deleted.

Note

For specific information on working with the predefined tree structures that existin an Oracle Fusion application, refer to the specific product documentation.

Setting Status

If you change the status of a tree structure, the status of the trees and treeversions associated with that tree structure also changes.

The following table lists the different statuses of a tree structure.

Status Meaning

Draft Yet to be published or is in a modified state.


Active In use and based on which one or more trees or treeversions are created.

Inactive Not in use.

Tree Structure Audit Results: Explained

Use the tree structure audit results to verify the tree structure's correctness anddata integrity. The audit results include the following details:

• The name of the validator, which is a specific validation check

• The result of the validation, including a detailed message

• Corrective actions to take if there are any validation errors

Running an Audit

Setting the status of a tree structure to active automatically triggers an audit ofthat tree structure. You can also manually trigger an audit on the manage TreeStructures page, using Actions - Audit . The Tree Structure Audit Result tableshows a list of validations that ran against the selected tree structure.

Validation Details

The following table lists the validators used in the audit process and describeswhat each validator checks for. It also lists possible causes for validation errorsand suggests corrective actions.

Validator Description (what ischecked)

Possible Cause forValidation Failure

Suggested CorrectiveAction

Restrict By Set ID On the Manage TreeStructures: Specify DataSources page, if the SetID check box is selectedto enable the RestrictTree Node List of ValuesBased on option for atree structure, each of itsdata source view objectsmust have a referencedata set attribute. Thisvalidation does not takeplace when the check boxis not selected.

Even when the checkbox is selected, one ormore of its data sourceview objects does notcontain a reference dataset attribute.

If reference data setrestriction is requiredfor this tree structure,include a reference dataset attribute on all datasources. Otherwise,deselect the check box.

Row Flattened TableName

On the Manage TreeStructures: SpecifyPerformance Optionspage, a valid rowflattened table mustbe specified for thetree structure. It caneither be the standardrow flattened tableFND_TREE_NODE_RF or acustom table.

• The specified tabledoes not exist inthe database.

• The specifiedtable does notcontain the samecolumns as theFND_TREE_NODE_RFtable.

Correct the row flattenedtable definition.


Available Label DataSources

On the Manage TreeStructures: SpecifyData Sources page, ifa labeling scheme isspecified for the treestructure by selectinga list item from theLabeling Scheme listbox, the label data sourceview object specified foreach data source mustbe accessible, and theprimary keys must bevalid. This restrictiondoes not apply whenyou select None fromthe Labeling Scheme listbox.

• Any of thespecified label datasource view objectsdo not exist.

• Any of thespecified labeldata source viewobjects do not haveprimary keys.

• When a labeldata source viewobject is initiallydefined, thedatabase registersthe primary keysfor the view object.If the view object islater modified suchthat its primarykeys no longermatch the primarykeys that wereregistered earlier,this validationfails.

• Correct thespecified label datasource view object.

• Correct theprimary keys of thespecified label datasource view object.

• Either correct theprimary keys in thelabel data sourceview object tomatch the primarykeys that wereearlier registered inFND_TS_DATA_SOURCE,or correct theprimary keysregistered in thattable to match thenew view objectdefinition.


Available Data Sources Each data source viewobject specified for thetree structure must beaccessible, and all itsprimary key attributesmust be valid.

• Any of thespecified datasource view objectsdo not exist.

• When a datasource view objectis initially defined,the databaseautomaticallyregisters theprimary keys forthe view objectif the Use non-defined primarykey columns checkbox on the DataSource dialog boxis not selected.If the check boxis selected, thedatabase registersthe primary keysspecified explicitlyby the user on theAdd Data Sourcedialog box. If theregistered primarykeys contain anyduplicates, thisvalidation fails.

• The Use nondefined primarykey columns checkbox is selected ina data source, butthe list of specifiedprimary keycolumns does notmatch the primarykeys defined in thecorresponding datasource view object.

• Any commonattribute that existsin both the datasource view objectand the tree nodeview object is notof the same datatype in both viewobjects.

• Correct thespecified datasource view object.

• Correct theduplicate columnin the registeredprimary keys.

• Correct theprimary keys ofthe specified datasource view object.

• Correct anymismatch in datatypes.


Column Flattened TableName

On the Manage TreeStructures: SpecifyPerformance Optionspage, a valid columnflattened table mustbe specified for thetree structure. It caneither be the standardrow flattened tableFND_TREE_NODE_CF or acustom table.


• The specifiedtable does notcontain the samecolumns as theFND_TREE_NODE_CFtable.

Correct the columnflattened table definition.

Restrict by Date On the Manage TreeStructures: Specify DataSources page, if theDate Range check boxis selected to enablethe Restrict Tree NodeList of Values Basedon option for a treestructure, each of itsdata source view objectsmust have effective startdate and effective enddate attributes. Thisvalidation does not takeplace when the check boxis not selected.

Even when the checkbox is selected, one ormore of its data sourceview objects does notcontain effective startdate and effective enddate attributes.

If the date restrictionis required for thistree structure, includethe effective start dateand effective end dateattributes on all datasources. Otherwise,deselect the check box.

Tree Node Table Name On the Manage TreeStructures: SpecifyDefinition page, a validtree node table mustbe specified for thetree structure. It caneither be the standardrow flattened tableFND_TREE_NODE or acustom table.

• No table isspecified in theTree Node Tablefield.


• The specifiedtable does notcontain the samecolumns as theFND_TREE_NODEtable.

Correct the tree nodetable definition.

Allow Node LevelSecurity

If the Allow Node LevelSecurity option is set toNo for the tree structure,the same option cannotbe set to Yes on any ofits data sources. Thisis a database settingthat is not visible on theManage Tree Structurespage.

The option is set to Nofor the tree structure butone or more associateddata sources have thatoption set to Yes.

Correct the option settingin the tree structure andtheir data sources.

Specifying Data Sources for Tree Structures: Points to Consider

The data sources provide the items for establishing hierarchy in a tree structure.In the tree management infrastructure, these data sources are Oracle Application


Development Framework (ADF) business components view objects, which aredefined by application development.

Labeling Schemes

Selecting a labeling scheme determines how the tree nodes are labeled. You mayselect a labeling scheme to assign at the data source level, at the parent nodelevel, or keep it open for customer assignment. You may also choose not to haveany labeling scheme. However, if you decide to use any of the labeling schemes,you may need to select the following additional options, to restrict the list ofvalues that appear under the selected tree node.

• Allow Ragged Nodes: To include nodes that have no child nodes, and areshorter than the remaining nodes in the entire hierarchy.

• Allow Skip Level Nodes: To include nodes that are at the same level buthave parent nodes at different levels.

Restriction of Tree Node Values

You can decide the depth of the tree structure by selecting an appropriate valuefrom the list. Keeping the depth limit open renders an infinite list of values.

Using the following options, you can restrict the list of values that appear forselection under a specific tree node.

• Date Range: Specifies whether a selection of nodes should be restricted tothe same date range as the tree version.

• Allow Multiple Root Nodes: Allows you to add multiple root nodeswhen creating a tree version.

• Reference Data Set: Specifies whether a selection of nodes should berestricted to the same set as the tree.

Data Source Values and Parameters

Tree data sources have optional data source parameters with defined viewcriteria and associated bind variables. You can specify view criteria as a datasource parameter when creating a tree structure, and edit the parameters whencreating a tree. Multiple data sources can be associated with a tree structure andcan have well-defined relationships among them.

Note

Parameter values customized at the tree level override the default valuesspecified at the tree-structure level.

The data source parameters are applied to any tree version belonging tothat data source, when performing node operations on the tree nodes. Datasource parameters also provide an additional level of filtering for different treestructures. The tree structure definition supports three data source parametertypes.

• Bound Value: Captures any fixed value, which is used as part of the viewcriteria condition.

• Variable: Captures and binds a dynamic value that is being used by thedata source view object. This value is used by the WHERE condition ofthe data flow.

• View Criteria: Captures the view criteria name, which is applied to thedata source view object.


You can also specify which of the data source parameters are mandatory whilecreating or editing the tree structure.

View objects from the ADF business components are used as datasources. To associate the view object with the tree structure, youcan pick the code from ADF business component view objects andprovide the fully qualified name of the view object, for example,oracle.apps.fnd.applcore.trees.model.view.FndLabelVO.

Specifying Performance Options for a Tree Structure: Points to Consider

Tree structures are heavily loaded with data. As a tree management guideline,use the following settings to improve performance of data rendering andretrieval.

• Row Flattening

• Column Flattening

• Column Flattened Entity Objects

• ADF Business Component View Objects

Row Flattening

Row flattening optimizes parent-child information for run-time performanceby storing additional rows in a table for instantly finding all descendants ofa parent without initiating a CONNECT BY query. Row flattening eliminatesrecursive queries, which allows operations to perform across an entire subtreemore efficiently.

To store row flattened data for the specific tree structure, users can eitheruse the central FND_TREE_NODE_RF table or they can register their own rowflattened table. For example, in a table, if Corporation is the parent of SalesDivision (Corporation-Sales Division), and Sales Division is the parent of Region(Sales Division-Region), a row-flattened table contains an additional row withCorporation directly being the parent of Region (Corporation-Region).

Column Flattening

Column flattening optimizes parent-child information for run-time performanceby storing an additional column in a table for all parents of a child.

To store column flattened data for the specific tree structure, users can eitheruse the central FND_TREE_NODE_CF table or they can register their own columnflattened table. For example, in a table, if Corporation is the parent of SalesDivision (Corporation-Sales Division), and Sales Division is the parent ofRegion (Sales Division-Region), a flattened table in addition to these columns,contains three new columns: Region, Sales Division, and Corporation. Althoughpositioned next to each other, the column Region functions at the lower level andCorporation at the higher level, retaining the data hierarchy.

Column Flattened Entity Objects

In the absence of a column-flattened table, if you need to generate the businesscomponent view objects for your tree structure for the flattened table, use thetree management infrastructure to correctly provide the fully qualified name ofthe entity object for the column flattened table.


ADF Business Component View Objects

View objects from the ADF business components can also be used as datasources, eliminating the need to create new types of data sources. This fieldis to store the fully qualified name for the business component view objectgenerated by the tree management for business intelligence reporting and usageThe business component view object is a combination of the tree data sourceand column flattened entity. Using this option prevents data redundancy andpromotes greater reuse of existing data, thereby improving the performance ofthe tree structure.

Manage Tree Labels

Tree Labels: Explained

Tree labels are tags that are stored on tree nodes. You can store labels in any tableand register the label data source with the tree structure. When a labeling schemeis used for trees, the selected labels are stored in the tree label entity and eachtree node contains a reference to a tree label in the labeling scheme.

The following table lists the three ways in which tree labels are assigned to thetree nodes.

Labeling Scheme Description

Level Labels that are automatically assigned based on thedata source to which the tree node belongs. A levellabel points to a specific data source. For example,in a tree that reflects the organizational hierarchy ofan enterprise, all division nodes appear on one leveland all department nodes on another.

Group Labels that you can arbitrarily assign to tree nodes.

Depth Labels that are automatically assigned based on thedepth of the tree node within the tree. No manualassignment is performed.

Note

In an unbalanced hierarchy, a level may not be equalto depth.

Manage Trees and Tree Versions

Managing Trees and Tree Versions: Points to Consider

You can create and edit trees and tree versions depending upon the requirement.A tree can have one or more tree versions. Typically, when changes are made toan existing tree, a new version is created and published.


Creating and Editing Trees

Trees are created based on the structure defined in the tree structure. You cancreate trees, modify existing trees, and delete trees. If you want to copy anexisting tree, you can duplicate it. However, only the tree is duplicated and notits versions.

Creating a tree involves specifying the tree definition and specifying the labelsthat are used on its nodes. If the selected tree structure has data sources andparameters defined for it, they appear on the page allowing you to edit theparameter values at the tree node level.

Note

Parameter values customized at the tree level will override the default valuesspecified at the tree-structure level.

Creating and Editing Tree Versions

Tree versions are created at the time of creating trees. A tree must contain aversion.

Editing an existing tree provides you the choice to update the existing version.You can also edit the existing version that lies nested under the tree in the searchresults.

When you edit a tree version bearing Active status, the status changes to Draftuntil the modifications are saved or cancelled.

Tree Version Audit Results: Explained

Use the tree version audit results to verify the tree version's correctness and dataintegrity. The audit results include the following details:

• The name of the validator, which is a specific validation check

• The result of the validation, including a detailed message

• Corrective actions to take if there are any validation errors

Running an Audit

An audit automatically runs whenever a tree version is set to active. You can alsomanually trigger an audit on the Manage Trees and Tree Versions page, using Actions - Audit . The Tree Version Audit Result table shows a list of validationsthat ran against the selected tree version.

Validation Details

The following table lists the validators used in the audit process and describeswhat each validator checks for. It also lists possible causes for validation errorsand suggests corrective actions.

Validator Description (what ischecked)

Possible Cause forValidation Failure

Suggested CorrectiveAction

Effective Date The effective start andend dates of the treeversion must be valid.

The effective end date isset to a value that is notgreater than the effectivestart date.

Modify the effective startand end dates such thatthe effective start date isearlier than the effectiveend date.


Root Node On the Manage TreeStructures: Specify DataSources page, if theAllow Multiple RootNodes check box forthe Restrict Tree NodeList of Values Based onoption is not selected,and if the tree structureis not empty, the treeversion must containexactly one root node.This validation does nottake place if the checkbox is selected.

Even if the check boxis deselected, the treeversion has multiple rootnodes.

Modify the tree versionsuch that there is exactlyone root node.

Data Source Max Depth For each data source inthe tree structure, on theData Source dialog box, ifthe data source is depth-limited, the data in thetree version must adhereto the specified depthlimit. This validationdoes not apply to datasources for which theMaximum Depth field isset to Unlimited.

The tree version has dataat a depth greater thanthe specified depth limiton one or more datasources.

Modify the tree versionsuch that all nodes areat a depth that complieswith the data sourcedepth limit.

Duplicate Node On the Data Sourcedialog box, if the AllowDuplicates check boxis not selected, the treeversion should notcontain more than onenode with the sameprimary key from thedata source. If the checkbox is selected, duplicatenodes are permitted.

Even when the checkbox is deselected, thetree version containsduplicate nodes.

Remove any duplicatenodes from the treeversion.


Available Node All nodes in the treeversion should be validand available in theunderlying data source.

• A node in the treeversion does notexist in the datasource. Deletingdata items fromthe data sourcewithout removingthe correspondingnodes from the treeversion can resultin orphaned nodesin the tree version.For example, if youadded node A intoyour tree version,and subsequentlydeleted node Afrom the datasource withoutremoving it fromthe tree version,the validation fails.

• The tree versioncontains a treereference node,which referencesanother treeversion that doesnot exist.

Remove any orphanednodes from the treeversion. Update treereference nodes so thatthey reference existingtree versions.

Node Relationship All nodes must adhereto the relationshipsmandated by the datasources registered in thetree structure.

The tree structure hasdata sources arrangedin a parent-childrelationship, but thenodes in the tree donot adhere to the sameparent-child relationship.For example, if the treestructure has a Projectdata source with a Taskdata source as its child,Task nodes shouldalways be under Projectnodes in the tree version.This validation fails ifthere are instances wherea Project node is addedas the child of a Tasknode.

Modify the treeversion such that thenodes adhere to thesame parent-childrelationships as the datasources.


SetID Restricted Node On the Manage TreeStructures: Specify Datasources page, if the SetID check box is selectedto enable the RestrictTree Node List of ValuesBased on option for eachtree node, the underlyingnode in the data sourcemust belong to the samereference data set as thetree itself. This restrictiondoes not apply when thecheck box is not selected.

Even when the checkbox is selected, thetree version has nodeswhose data source valuesbelong to a differentreference data set thanthe tree.

Modify the tree versionsuch that all nodes in thetree have data sourceswith reference data setmatching that of the tree.

Label Enabled Node On the Manage TreeStructures: SpecifyData Sources page, ifa labeling scheme isspecified for the treestructure by selectinga list item from theLabeling Schemelist box, all nodesshould have labels. Thisrestriction does notapply when you selectNone from the LabelingScheme list box.

The tree structure has alabeling scheme but thetree version has nodeswithout labels.

Assign a label to anynode that does not have alabel.


Date Restricted Node On the Manage TreeStructures: Specify DataSources page, if theDate Range check boxis selected to enablethe Restrict Tree NodeList of Values Basedon option for a treestructure, each nodein the underlying datasource must have aneffective date range sameas the effective daterange of the tree version.This restriction does notapply if the check box isnot selected.

Even when the checkbox is selected, thereare data source nodesthat have a date rangebeyond the tree version'seffective date range.For example, if thetree version is effectivefrom Jan-01-2012 toDec-31-2012, all nodesin the tree versionmust be effectivefrom Jan-01-2012to Dec-31-2012 ata minimum. It isacceptable for the nodesto be effective for a daterange that extends partlybeyond the tree version'seffective date range (forexample, the node datasource value is effectivefrom Dec-01-2011 toMar-31-2013). It is notacceptable if the nodesare effective for noneor only a part of thetree version's effectivedate range (for example,the node data sourcevalue are effective onlyfrom Jan-01-2012 toJune-30-2012).

Ensure that all nodesin the tree version haveeffective date range forthe effective date rangefor the tree version.

Multiple Active TreeVersion

On the Manage TreeStructures: SpecifyDefinition page, if theAllow Multiple ActiveTree Versions checkbox is not selected forthe tree structure, thereshould not be more thanone active tree versionunder a tree at any time.This restriction does notapply if the check box isselected.

Even when the check boxis not selected, there ismore than one active treeversion in the tree for thesame date range.

Set no more than one treeversion to Active withinthe same date range andset the others to inactiveor draft status.

Range Based Node On the Data Sourcedialog box, if the AllowRange Children checkbox is not selected,range-based nodes arenot permitted fromthat data source. Thisrestriction does notapply if the check box isselected.

Even when the check boxis not selected, there arerange-based nodes froma data source.

Ensure that any rangenodes in your treeversion are from a datasource that allows rangechildren.


Terminal Node On the Data Sourcedialog box, if the AllowUse as Leaves check boxis not selected, valuesfrom that data sourcecannot be added asleaves (terminal nodes)to the tree version. Thisrestriction does notapply if the check box isselected.

Even when the check boxis not selected, valuesfrom a data source areadded as leaf nodes(terminal nodes).

Modify the tree versionsuch that all terminalnodes are from datasources for which thischeck box is selected.

Usage Limit On the Data Sourcedialog box, if the Use AllValues option is selectedto set the Usage Limitfor the data source, everyvalue in the data sourcemust appear as a node inthe tree. This restrictiondoes not apply if Noneoption is selected.

Even if the Use AllValues option is selected,there are values in thedata source that are notin the tree version.

For each data sourcevalue that is not yetavailable, add nodes tothe tree version.

Trees and Data Sources: How They Work Together

Data sources form the foundation for tree management in Oracle FusionApplications. Tree structures, trees, and tree versions establish direct andreal-time connectivity with the data sources. Changes to the data sourcesimmediately reflect on the Manage Trees and Tree Versions page and whereverthe trees are being used.

Metadata

Tree structures contain the metadata of the actual data that is used in OracleFusion Applications. Tree structures contain the core business logic that ismanifested in trees and tree versions.

Data Storage

Trees and tree versions are built upon the tree structures. They employ thebusiness rules defined in the tree structures and allow an application to selectand enable a subset of trees to fulfill a specific purpose in that application.

Access Control

Source data is mapped to tree nodes at different levels in the database. Therefore,changes you make to the tree nodes affect the source data. Access control set ontrees prevents unwanted data modifications in the database. Access control canbe applied to the tree nodes or anywhere in the tree hierarchy.

Adding Tree Nodes: Points to Consider

Tree nodes are points of data convergence that serve as the building blocks of atree structure. Technically, the node may be stored either in a product-specific


table or in an entity that has been established by tree management as the defaultstorage mechanism. However, since all data in Oracle Fusion Applicationsusually have a storage home, only user-created data needs to be stored in anentity.

Nodes are attached to tree versions. Whenever you create or edit a tree version,you need to specify its tree node.

Managing Tree Nodes

You can create, modify, or delete tree nodes on the Tree Version: Specify Nodespage. To add a tree node, ensure that the tree structure with which the treeversion is associated is mapped to a valid data source. You can also duplicate atree node if the multiple root node feature is enabled.

Node Levels

In most trees, all nodes at the same level represent the same kind of information.For example, in a tree that reflects the organizational hierarchy, all division nodesappear on one level and all department nodes on another. Similarly, in a tree thatorganizes a user's product catalog, the nodes representing individual productsmight appear on one level and the nodes representing product lines on the nexthigher level.

When levels are not used, the nodes in the tree have no real hierarchy orreporting structure but do form a logical summarization structure. Strictlyenforced levels mean that the named levels describe each node's position in thetree. This is natural for most hierarchies. Loosely enforced levels mean that thenodes at the same visual level of indentation do not all represent the same kindof information, or nodes representing the same kind of information appear atmultiple levels. With loosely enforced levels, users assign a level to each nodeindividually. The level is not tied to a particular visual position.

Node Types

A tree node has the following node types.

• Single: Indicates that the node is a value by itself.

• Range: Indicates that the node represents a range of values and possiblycould have many children. For example, a tree node representing accountnumbers 10000 to 99999.

• Referenced Tree: Indicates that the tree node is actually another versionfor the tree based on the same tree structure, which is not physicallystored in the same tree. For example, a geographic hierarchy for theUnited States can be referenced in a World geographic hierarchy.

Define Profile Options

Profile Options: Explained

Profile options manage configuration data centrally and influence the behaviorof applications. Profile options serve as permanent user preferences and


application configuration parameters. You configure profile options withsettings for specific contexts or groups of users. Users customize how their userinterfaces look and behave by changing the values of available profile options.

Profile options store the following kinds of information.

Type of Information Profile Option Example

User preferences Settings to provide access to social networkingfeatures

Installation information Setting to identify the location of a portal

Configuration choices Settings to change user interface skins and behaviors

Processing options Settings to affect how much information to log eitherfor an entire site or a specific user

You can add and configure new profile options in addition to configuringpredefined profile options that are implemented as updateable.

Profile Option Definition and Configuration

Application developers add new profile options and configure ones that are notto be updated by other users. Application administrators and implementationconsultants configure profile options with profile option values that areimplemented as updatable.

Profile option definitions consist of the following.

• Profile option name

• Application and module in the application taxonomy

• Profile option values

• Profile options categories

• Profile option levels

• Profile option level hierarchy

Profile options can appear on any user interface page without indication that aprofile option is what is being set.

Profile Option Values

Some profile options have predefined profile option values.

The Manage Profile Option Values task flow allows an administrator to setupdatable profile option values at the available levels, including the user level.You can access the Manage Profile Option Values task starting in the Setup andMaintenance Overview page and searching for profile option tasks.

You can set profile option values at different levels: site, product, and user. Thefollowing table provides examples.


Profile Option Level Value of the ProfileOption Level

Profile Option Value Effect

User Manager1 UK pound sterling Access to site and allproducts shows UKpounds sterling in effect

User Manager2 US dollar Access to site and allproducts shows USdollars in effect

Product Financials for EMEA Euro Unless superseded by auser level value, Euros ineffect for Financials forEMEA applications

Site Site UK pound sterling UK pounds sterling ineffect for all other usersand products

Context such as user session or accessed product determines which profileoption value is associated with the profile option name. In the example, ifmanager1 does not set a profile option value for this profile option, access toFinancials for EMEA shows currency in Euros; and access to other productsshows currency in UK pounds sterling.

Profile Option Categories

Categories group profile options based on their functional area. Profile optioncategories facilitate searching and defining data security.

For example, in Oracle Fusion Receivables, the Transactions profile optioncategory groups profile options related to setting how Receivables transactionsare to be processed, such as Require Adjustment Reason.

A profile option can be in more than one category.

Profile Option Hierarchies and Levels

Application developers specify at which hierarchy level a profile option isenabled. The predefined profile option hierarchy levels are site, product, anduser.

The hierarchy levels specified in the profile option definition determine thecontext in which a profile option value may be set. If the profile option value ata particular level is updatable, an administrator can update the profile optionvalue for that context.

Note

Profile options should only be enabled for context levels that are appropriatefor that profile option. For example, a profile option indicating a globalconfiguration setting should not be enabled at the user level, if users cannotchoose a different value for that setting.

For security, one level in the hierarchy is designated as a user level. A profileoption may be enabled at any or all hierarchy levels. When enabled at all levels,


the predefined ordering of profile option hierarchy levels gives precedence to thevalues that are set at the user level over values set at the product and site levels,and precedence to values set at the product level to values set at the site level. Ifthere is no value for the current user, then the product value applies. If there isno value for the user or product, then the site value applies.

The table shows the predefined profile option hierarchy and ordering.

Hierarchy Level Priority When MultipleLevels Set

Effect on Applications Example

Site Lowest Affect all applications fora given implementation

Currency for the site isset to Euros.

Product Supersedes Site Affect all applications ofa product family such asFinancials

Currency for theFinancials products set toUK pound sterling.

User Highest, supersedesProduct

Affect only theexperience of the currentuser

Currency for the user ofFinancials applicationsset to US dollars.

You can configure updatable values for profile options at one or more levelsdepending on which levels are enabled in the profile option definition. When aprofile is set at more than one level, higher levels of specificity override lowerlevels of specificity.

In the example, if the currency setting for the site is UK pounds sterling, butthe Financials division works in the Netherlands using the Euro, a manager inthe US can override that product level setting at the user level to use US dollarswhen accessing Financials applications.

In another example, if a profile option called Printer is set only at the site andproduct levels. When a user logs on, the Printer profile option assumes the valueset at the product level, since it is the highest level setting for the profile.

Tip

Set site-level profile option values before specifying values at any other level.The profile option values specified at the site-level work as defaults until profileoption values are specified at the other levels.

For more information on the predefined profile options, see assets with theProfile Option type in the Oracle Enterprise Repository for Oracle FusionApplications (http://fusionappsoer.oracle.com).

Planning Profile Options: Points to Consider

Plan profile options before defining and configuring them.

The following aspects assist you in better planning how to manage profileoptions.

• Profile option tasks


• Before creating a profile option

• Profile options data model

Profile Option Tasks

Users may be able to set their own profile options, depending on settings in theprofile option definition. However, not all profile options are visible to end users,and some profile options, while visible, may not be updated by end users.

The following table lists tasks and considerations relevant to planning profileoptions.

Tasks Role Considerations

Planning, creating, and editing anew profile option

Applications developer Since profile options are forpermanent settings, do notuse profiles options to cachetemporary session attributes.

Add capacity for user preferencesand system configuration.Customize profile optionswith values, value behaviors,validation, category values, andsecurity. Define the levels at whichthe profile option is enabled.

Configure values in an existingprofile option

Applications developer,application administrator, andimplementation consultant

Manage the values for existingprofile options.

Create and edit profile optioncategories

Applications developer,application administrator, andimplementation consultant

Manage categories for organizingexisting profile options.

Note

Since a profile option enables a behavior in an application user interface oracross applications, a value change made by an end user is reflected in the UIpage for managing profile option values.

Before Creating a Profile Option

Profile options are best defined for managing configuration data centrally andinfluencing the behavior of applications.

If the purpose of a profile option setting is specific to a piece of data (typicallysetup data), it is best implemented as an attribute of that data.

Do not use profile options for behavior that is not configurable.

Profile options exist independent of role.

Do not use profile options to implement function security. For example, anapplication should not check for a profile option value set to yes to provide


access to a page. Do not use profile options to implement data security, such as aprofile option value that must be set to a specific value to provide view access toan entity.

Do not use profile options to capture a dynamic system states, such as datastored in a temporary table. Use Global Variables for temporary states instead.

Evaluate if there is a genuine need before creating a profile option. Do not forceusers to make a decision about an aspect of their application use that is of noconcern.

Evaluating need includes looking for duplicate or similar profile options, evenin other products, before creating a new one. For example, you do not needmultiple profile options to choose a preferred currency.

Profile Options Data Model

The profile option data model illustrates the relationships among profile optionelements.

The figure shows the data model of profile option entities.

For more information about planning profile options, see the Oracle FusionApplications Developer's Guide.

Managing Profile Options: Points to Consider

A profile option definition consists of a name for the profile option and validvalues. It is defined within a module of the application taxonomy. Applicationdevelopers manage profile options to create new profile options or modifyexisting profile option definitions, which includes specifying the levels at whicha profile option is enabled and defining values. Implementation consultants


and application administrators configure existing profile options by managingthe profile option's updatable values, and creating categories that group profileoptions.

Configuring a Profile Option

A profile option definition includes information about the owning applicationand module in the application taxonomy. A start or end date, or both may limitwhen a profile option is active. The profile option definition may include an SQLvalidation statement that determines which values are valid, and the hierarchylevels at which the profile option is enabled and updatable.

To be visible to users, a profile option must be user enabled. You can also allowuser updates of the profile option, which means users can make changes to thevalidation and the profile option level information.

Profile option levels specify at which context level profile values may be enabledor updated

Profile options should only be enabled for context levels that are appropriatefor that profile option. For example, a profile option indicating a globalconfiguration setting should not be enabled at the user level, if users cannotchoose a different value for that setting.

SQL Validation

The SQL validation of the profile option definition determines what valid profileoption values are available. In the absence of validation, any value is valid.

For example, SQL validation provides a means of defining a list of values for thevalid values of the profile option. The SQL validation can use lookups to providethe valid values for profile options, such as the lookup codes of the YES_NOlookup type.

With a profile option called DEFAULT_LANGUAGE, you can configure thefollowing validation.

SELECT DESCRIPTION Language, NLS_LANGUAGEFROM FND_LANGUAGES_VLWHERE INSTALLED_FLAG IN ('B','I')ORDER BY DESCRIPTION

This results in the following list of values based on data in FND_LANUGUAGE_VL.

Display Value Hidden Value

American English US

French F

Spanish E

Hidden values must be varchar2(2000).

Profile options generally provide configuration values within a particularcontext. Though you can create a profile option to be global, think of globalvalues as default values to avoid storing inappropriate configuration


information as profile option values. Create global profile options that havecorresponding contextual levels.

Managing Profile Option Categories: Points to Consider

Use profile option categories to group profile options.

Organizing Profile Options in Categories

As a guideline, group profile options in a single category if the profile optionsaffect the same feature, or if an administrator would likely want to see the profileoptions in the results of a single search.

Application developers are responsible for the initial groupings and thenadministrators can make changes based on their specific needs. Administratorscan categorize profile options and then easily search on profile options bycategory.

Tip

Define profile option categories first and assign new profile options to existingcategories rather than defining profile options first and then defining categoriesto categorize them.

Adding New Profile Option Categories

You can add new categories or add profiles to an existing category.

You can create a profile option category by duplicating an existing category andediting it for a new grouping of profile options. You can add multiple profileoptions to a category. A profile option can exist in multiple categories.

Profile Option Order in a Category

Specify a profile option sequence to determine the order of profile options whenqueried by profile option category.

Viewing and Editing Profile Option Values: Points to Consider

A profile option value consists of the value and the context or level where thevalue is set. You specify the context with a pairing of the profile option value'slevel and level value, such as the product level and the level value GL for OracleFusion General Ledger. Adding or modifying profile option values can includedeciding which valid values are enabled or updatable at which level.

The SQL validation of the profile option definition determines what valid profileoption values are available. In the absence of validation, any value is valid.


Profile Option Levels and User Session Context

Site level profile option values affect the way all applications run for a givenimplementation. Product level profile option values affect the way applicationsowned by a particular product code behave. For example, a product may useprofile options set at the product level to determine how regions providedby a common module such as those available from Oracle Fusion TradingCommunity Model or Customer Relationship Management (CRM) display ina particular work area or dashboard. User level profile option values affect theway applications run for a specific application user

Whichever profile option value is most specific to a user session, that is the valueat which the profile option is set for the user session.

For example, the predefined FND_LANGUAGE profile option sets the defaultlanguage. In addition to a site level value, you can define a value for variousproduct or user levels.

Level Name Level Value Profile Option Value

Site InFusion American English

Product Customer Center French

Product CRM Application Composer American English

User Application Administrator American English

User Hima Hindi

Values at the site level take effect for any user unless overridden by a differentvalue set at the more specific levels of product and user. Product level profileoption values affect the way applications owned by a particular product codebehave. In addition to user level profile option values in applications, selectionsmay be available in the user preferences workspace.

The following table demonstrates the FND_LANGUAGE profile option settingsthat would apply to specific users, based on the example above. For example, theuser Hima is using the CRM Application Composer product, in the InFusion site.The example above shows that this profile option is set to Hindi at the user levelfor Hima. Because user is the highest applicable level for Hima, the applicableprofile option value is Hindi for Hima.

Site Product User Highest AvailableLevel

Active ProfileOption Value

InFusion CRM ApplicationComposer

Hima User Hindi

Acme Payables ApplicationAdministrator

User American English

InFusion Customer Center Guillaume Product French

InFusion Payables ImplementationConsultant

Site American English

Acme Payables ImplementationConsultant

none no value


Note

More than one site level value is relevant in an enterprise with multiple tenantsusing a single instance of Oracle Fusion Applications.

Effect of Changes to Profile Option Values

Any change you make to a user level profile option has an immediate effect onthe way applications run for that session. When you sign in again, changes madeto your user level profile options in a previous session are still in effect. Whenyou change profile option value at the product level and no user level values areset, you see the update immediately, but other users may not see the changedvalue until signing out and back in. When you change a profile option value andthe new value affects other users, the change takes effect only when users sign inthe next time.

Changes to site level profile options take effect for any user session that is startedafter the setting has been changed. Changes to site or user level profile optionsdo not affect any user sessions that are already in progress when the change ismade.

Changes to site or user level profile options take effect for any C or PL/SQLprocesses, such as scheduled jobs, that are launched after the setting has beenchanged. Profile option changes do not affect C or PL/SQL processes that arealready running.

Define Flexfields

Flexfields: Overview

A flexfield is an extensible set of placeholder fields in application pages thatare associated with a business object. Each segment of the flexfield correspondsto a single application field, such as a segment of a key identifying a particularpurchase, or the components of a student's contact information, or the features ofa product in inventory.

Using descriptive and extensible flexfields, you can extend business objectsto capture data that wouldn't otherwise be tracked by the application. If youneed to add custom fields to a business object to meet your enterprise-specificrequirements, configure the flexfield to have one segment for each needed field.

Using key flexfields, you can configure intelligent key codes comprised ofmeaningful parts according to your business practices. You configure the keyflexfield to have one segment for each part that makes up your key code.

Flexfields let you meet enterprise requirements without changing the datamodel. Different data can be captured on the same database table. Each segmentcaptures a single atomic value, has a name, and maps to a pre-reserved columnin the application database.


You can use a flexfield to extend a business object if it has been registered for useon that object. Application developers create a flexfield and register it so that itis available for configuration. Administrators and implementation consultantsset up or configure segments and other properties of the available flexfields. Endusers see flexfield segments as fields or attributes of information displayed in theapplication user interface. They enter a value for the attribute. The value may beselected from a list of valid values or entered as free-form text that complies withformatting rules.

The following aspects provide an overview of flexfields:

• Accessing flexfields and flexfield management tasks

• Types of flexfields

• Flexfield segments

• Value sets

• Structure and context

• Deployment

• Runtime appearance

Accessing Flexfields and Flexfield Management Tasks

You can view flexfields on a page where they occur using the HighlightFlexfields feature. You can access flexfield management tasks directly from ahighlighted flexfield, through product-specific flexfield management tasks, or bystarting in the Setup and Maintenance Overview page which is available fromthe Navigator or the Administration menu.

For lists of flexfields, see assets with the Flexfield: Descriptive, Flexfield:Extensible, or Flexfield: Key type in Oracle Enterprise Repository for OracleFusion Applications (http://fusionappsoer.oracle.com).

Types of Flexfields

The following three types of flexfields are available in Oracle FusionApplications and provide a means to customize applications features withoutprogramming.

• Key

• Descriptive

• Extensible

For example, in Oracle Fusion Financials, key flexfields represent objects suchas accounting codes and asset categories. Generally, correct operations of aproduct depend on key flexfield setup. In Oracle Fusion Payables, a descriptiveflexfield lets you collect custom invoice details fields on an invoices page.You can implement these fields, which are descriptive flexfield segments, ascontext-sensitive so they appear only when needed on a row-by-row basiswhen specific contextual information is met. Extensible flexfields are similar todescriptive flexfields, but provide additional advanced features. Generally, setup


of descriptive and extensible flexfields is optional because their segments capturecustom fields needed beyond the predefined fields.

Segments

Each field that you configure using flexfields is a flexfield segment. Segmentsrepresent attributes of information. They can appear globally wherever theflexfield is implemented, or based on a structure or context.

You define the appearance and meaning of individual segments whenconfiguring a flexfield.

A key flexfield segment commonly describes a characteristic of the entityidentified by the flexfield, such as a part number structured to includeinformation about the type, color, and size of an item. A descriptive flexfieldsegment represents an attribute of information that describes a characteristicof the entity identified on the application page, such as details about a devicecontaining components, some of which are globally present on the page whileothers are contextually dependent on the category of the device.

Value Sets

A value set is a named group of values that can be used to validate the content ofa flexfield segment.

You configure a flexfield segment with a value set that establishes the validvalues that an end user can enter for the segment. You define the values in avalue set, including such characteristics as the length and format of the values.You can specify formatting rules, or specify values from an application table orpredefined list. Multiple segments within a flexfield, or multiple flexfields, canshare a single value set.

Structure and Context

Key flexfields have structure. Descriptive flexfields and extensible flexfields havecontext.

Each key flexfield structure is a specific configuration of segments. Adding orremoving segments, or rearranging their order, produces a different structure.The database columns on which segments in different structures are based can bereused in as many structures as desired.

Descriptive flexfield segments can be context-sensitive, which means available toan application based on a context value rather than globally available whereverthe flexfield appears. A descriptive flexfield context is a set of context-sensitivesegments that store information related to the same context value. You definecontexts as part of configuring a descriptive flexfield. End users see globalsegments, as well as any context-sensitive segments that apply to the selectedcontext value.

Extensible flexfield segments are made available to an application based upona category value. An extensible flexfield context serves as a container forrelated segments, used to organize the various segments that are applicableto a category value. You define contexts with context-sensitive segments andassociate them to categories as part of configuring an extensible flexfield. Endusers see the segments displayed in subregions, one for each context associatedto the selected category value.


In descriptive flexfields and extensible flexfields, the database columns onwhich context-sensitive segments are based can be reused in as many contexts asdesired.

Deployment

A flexfield must be deployed to display its current definition in a runtimeapplication user interface. For example, if the deployment status is Edited, theflexfield segments may appear in the UI based on the flexfield definition at thetime of last deployment, rather than the current definition.

Runtime Appearance

In an application user interface, descriptive flexfield segments appear as labeland field pairs or as a table of fields where the column headers correspond to thelabels. The fields represent the flexfield segments and accept entered input or aselection from a list of choices that correspond to the segment's assigned valueset. Extensible flexfield segments appear grouped within labeled regions, whereeach grouping is a context and the region labels are the context names.

Use the Highlight Flexfields command in the Administration menu of theSetup and Maintenance work area to identify the location of the flexfields on theruntime page. Flexfields in highlight mode display an Information icon buttonto access details about the flexfield, an Edit icon button to manage the flexfield,and an Add Segment icon button to add flexfield segments.

All segments of a single flexfield are grouped together by default. The layoutand positions of the flexfield segments depend on where the applicationdeveloper places the flexfield on the page. Flexfields may also be presented in aseparate section of the page, in a table, or on their own page or subwindow.

You can use Oracle Composer to edit the layout, position, or other displayfeatures of the flexfield segments.

Flexfields and Oracle Fusion Application Architecture: How They Work Together

Administrators configure flexfield segments to capture data that represents thevalues of attributes. Flexfield segments represent attributes of entities (businessobjects). Most business objects are enabled for descriptive flexfields. Somebusiness objects are enabled for extensible flexfields.

For example, an airline manufacturer might require very specific attributes fortheir orders that aren't provided by the out-of-the-box implementation of anorder. Because a flexfield exists for the order business object, you can use it tocreate and configure the desired attribute.

The figure shows the layers of a flexfield: the business entity table and metadatain the database, business components that are Application DevelopmentFramework (ADF) objects or ADF business component (ADFbc) objects derivedfrom the metadata and stored in the Metadata Services Repository (MDS), andthe user interface where the input fields defined by the flexfield segments arerendered. The flexfield definition consists of all the metadata defined duringconfiguration and stored in the database.


Application developers create a flexfield and register it so that it is availablefor configuration. Administrators and implementation consultants configuresegments and other properties of the available flexfields. This information isstored as additional flexfield metadata in the database. Deploying the flexfieldgenerates ADF business components based on the flexfield metadata in thedatabase.

The following aspects are important in understanding how flexfields and OracleFusion Applications architecture work together:

• Integration

• Deployment

• Import and Export

• Runtime

• Patching

Integration

The attributes that you add by configuring flexfields are available throughoutthe Oracle Fusion Middleware technology stack, allowing the flexfields to beused in user interface pages, incorporated into the service-oriented architecture(SOA) infrastructure, and, in the case of descriptive flexfields, integrated withOracle Business Intelligence. You identify flexfield segments for integration bythe segment's Application Programming Interface (API) name.


A flexfield affects the Web Services Description Language (WSDL) schemasexposed by ADF services and used by SOA composites. The Web services thatexpose base entity data also expose flexfield segment data.

Attributes incorporate into SOA infrastructure (BPEL, Rules) and integratewith business intelligence (Oracle Business Intelligence, Extended Spread SheetDatabase (ESSbase)).

Flexfield configurations are preserved across Oracle Fusion Applicationsupdates.

Deployment

The metadata for the flexfield is stored in the application database as soon asyou save your configuration changes. Deploying the flexfield generates theADF business components so that the runtime user interface reflects the latestdefinition of the flexfield in the metadata.

Importing and Exporting

You can export and import flexfields with a deployment status of Deployedor Deployed to Sandbox across instances of Oracle Fusion Applications usingthe Setup and Maintenance Overview page. Ensure a flexfield is eligible formigration (by verifying that it has successfully deployed) prior to attempting themigration.

Runtime

For a flexfield to reflect the latest flexfield definition at runtime it must bedeployed. The user interface accesses a business object and the deployedflexfield definition indicates which business object attributes the flexfieldcaptures values for. If you add display customizations for a flexfield usingOracle Composer, these are customizations on the page so that the same flexfieldsegments can appear differently on various different pages.

Values entered for segments are validated using value sets.

Patching

Flexfield configurations are preserved during patching and upgrading.

Flexfield Management

Managing Flexfields: Points to Consider

Managing flexfields involves registering, planning, and configuring flexfields.

You plan and configure the registered flexfields provided in your applications byapplications developers. How you configure flexfield segments determines howthe flexfield segments appear to end users. Optionally, you can customize the UIpage to change how the flexfield segments appear to end users on that page.

The figure shows the processes involved in making flexfields available to endusers. The tasks in the Define Flexfields activity let administrators configure and


deploy flexfields. If you deploy a flexfield to a sandbox and decide to apply theconfiguration to the mainline, select the flexfield in the Manage Flexfields tasksof the Define Flexfields activity and deploy the flexfield in the mainline so that itis available to users.

Consider the following aspects of managing flexfields:

• Registering flexfields

• Planning flexfields

• Configuring flexfields

• Enabling a flexfields segment for business intelligence

• Deploying flexfields

• Optionally changing a flexfield segment's appearance in a user interfacepage

• Identifying flexfields on a runtime page and troubleshooting

Registering Flexfields

Application development registers flexfields so they are available toadministrators and implementation consultants for configuration.


As part of registering a flexfield, application development reserves columnsof entity tables for use in flexfields so an enterprise can capture segments tomeet their business needs. Many flexfields are registered in Oracle FusionApplications.

A flexfield must be registered before it can be configured.

For more information on registering flexfields, see Oracle Fusion ApplicationsDeveloper's Guide.

Planning Flexfields

Before you begin planning flexfields, determine what type is appropriate to yourneeds, and which business objects are available for customizing flexfields.

All flexfields consist of segments which represent attributes of an entity. Thevalues an end user inputs for an attribute are stored in a column of the entitytable.

Carefully plan flexfields before configuring them. Before configuring newsegments for your flexfields, be sure to plan their implementation carefully.

If you have determined that a business object supports flexfields, and thoseflexfields have been registered, you can begin planning how to configure theflexfield for your needs. Note the code name of the flexfield you intend toconfigure so you can find it easily in the Define Flexfield activity.

In some cases you can customize how the flexfield appears on the page.

See Oracle Fusion Applications Help for specific products to determine anyrestrictions on using product-specific flexfields.

Configuring Flexfields

Administrators or implementers configure flexfields so they meet the needsof the enterprise. Some flexfields require configuration to make an applicationoperate correctly.

You can configure flexfields using the following methods:

• Go to the manage flexfield tasks in the Setup and Maintenance work area.

• Use the Highlight Flexfields command in the Administration menu whileviewing a runtime page.

• Use the Configure Flexfield icon button to manage a flexfield, such aschange a segment's sequence number, or configure a flexfield segment'sbusiness intelligence label.

• Use the Add Segment icon button to add descriptive flexfield segmentsand context values, or extensible flexfield segments.

Configuring a flexfield includes the following:

• Defining value sets against which the values entered by end users arevalidated


• Defining the structure or context of the segments in the flexfield

• Specifying the identifying information for each segment

• Specifying the display properties such as prompt, length and data type ofeach flexfield segment

• Specifying valid values for each segment, and the meaning of each valuewithin the application

Tip

You can create value sets while creating descriptive and extensible flexfieldsegments. However, define value sets before configuring key flexfield segmentsthat use them, because you assign existing value sets while configuring keyflexfield segments.

When creating table-validated, independent, dependent, or subset value setswhile creating descriptive and extensible flexfield segments, you can optionallyspecify to display the description of the selected value to the right of the segmentat runtime.

You can assign sequence order numbers to global segments and to context-sensitive segments in each context. Segment display is always in a fixed orderbased on the segments' sequence numbers. You cannot enter a number for onesegment that is already in use for a different segment.

Tip

Consider numbering the segments in multiples, such as 4, 5, or 10, to make iteasy to insert new attributes.

A flexfield column is assigned to a new segment automatically, but you canchange the assignment before saving the segment. If you need to set a specificcolumn assignment for a segment, create that segment first to ensure that theintended column isn't automatically assigned to a different segment.

Enabling a Flexfield Segment for Business Intelligence

You can enable flexfield segments for business intelligence if the flexfield isregistered in the database as an Oracle Business Intelligence-enabled flexfield.For more information on enabling segments for business intelligence, see pointsto consider when enabling key and descriptive flexfield segments for businessintelligence.

For extensible flexfield segments, you can't assign labels and use equalization toprevent duplication.

Deploying Flexfields

Once you have configured a flexfield,, you must deploy it to make the latestdefinition available to runtime users.

In the Define Flexfields tasks, you can deploy a flexfield using either of thefollowing commands:


• The Deploy Flexfield command to deploy a flexfield to mainline. This isfor general use in a test or production environment.

• The Deploy to Sandbox command to deploy a flexfield to sandbox. This isto confirm that the flexfield is correctly configured before deploying it tothe mainline.

When using the Add Segment and Edit Segment tools for descriptive flexfieldsin Highlight Flexfields mode, you can use the Save and Deploy command to saveyour changes and deploy the flexfield to mainline.

Once deployed, the deployment status indicates the state of the currentlyconfigured flexfield relative to the last deployed definition.

Optionally Changing a Flexfield Segment Appearance

The flexfield attributes that you define integrate with the user interface pageswhere users access the attributes' business object. Application developmentdetermines the UI pages where business objects appear and the display patternsused by default to render flexfield segments.

After a flexfield has been deployed to a mainline metadata services (MDS)repository so that it appears on application pages, you can customize it on a per-page basis using Page Composer. For example, you can hide a segment, changeits prompt or other properties, or reorder the custom global attributes so thatthey are interspersed with the core attributes in the same parent layout.

You can only customize the appearance of descriptive and extensible flexfieldsegments in the UI page using Pge Composer once the flexfield is deployed tothe mainline.

If the Oracle Fusion applications are running in different locales, you can providedifferent translations for translatable text, such as prompts and descriptions.Enter translations by signing in using the locale that requires the translated text.You do this by selecting Set Preferences from the Personalization menu in theglobal area and changing the text to the translated text for that locale.

Identifying Flexfields on a Runtime Page and Troubleshooting

The Highlight Flexfields command in the Administration menu of the Setupand Maintenance work area identifies the location of flexfields on the runtimepage by displaying an Information icon button for accessing details about eachflexfield.

Even if a descriptive or extensible flexfield hasn't yet been deployed and nosegments appear on the runtime page in normal view, the flexfield appears inthe Highlight Flexfield view for that page. In the case of descriptive flexfields,the segments as of the last deployment appear. Highlight Flexfields accesses thecurrent flexfield metadata definition.

Use the highlighted flexfield's Edit icon button to manage flexfields directly.Alternatively, note a highlighted flexfield's name to search for it in the tasks formanaging flexfields.

To examine a flexfield's configuration, export the deployed artifacts using theexportMetadata WLST..


For more information on creating flexfields and adding them to a UI page, seethe Oracle Fusion Applications Developer's Guide.

For more information about customizing flexfield segment appearance withOracle Composer, see guidance on customizing existing pages in the OracleFusion Applications Extensibility Guide.

Flexfield Segment Properties: Explained

Independent of the value set assigned to a segment, segments may haveproperties that affect how they are displayed and how they behave.

The following aspects are important in understanding

• Display properties

• Properties related to segment values

• Properties related to search

• Range validation segments

• Rule validation of segment values

• Naming conventions

Display Properties

The following table summarizes display properties.

Property Description

Enabled Whether the segment can be used.

Sequence The order the segment appears in relation to theother configured segments.

Prompt The string to be used for the segment's label in theuser interface.

Display type The type of field in which to display the segment.

Checked and unchecked values If the display type is check box, the actual values tosave. For example, Y and N or 0 and 1.

Display size The character width of the field.

Display height The height of the field as measured in visiblenumber of lines when the display type is a text area.

Read only Whether the field should display as read-only, noteditable text.

Description help text The field-level description help text to display forthe field. Use description help text to display a field-level description that expands on or clarifies theprompt provided for the field.

If description help text is specified, a Help iconbutton is displayed next to the field in the runtimeapplication. The description help text is displayedwhen the user hovers over the Help icon button.


Instruction help text The field-level instruction help text to display for thefield.

Use instruction help text to provide directions onusing the field. If instruction help text is specified,it is displayed in an in-field help note window thatappears when users give focus to or hover over thefield.

Properties Related to Search

Extensible flexfield segments can be marked as selectively required in searchusing the indexed property. The indexed property requires end users to entera value before conducting a search on the attribute represented by the indexedsegment. A database administrator must create an index on the segment columnrepresenting the indexed attribute.

Range Validation of Segments

Range validation enables you to enforce an arithmetic inequality between twosegments of a flexfield. For example, a product must be ordered before it canbe shipped. Therefore, the order date must be on or before the ship date, andconsequently the order date segment value must be less than or equal to the shipdate segment value. You can use range validation to ensure this relationship.

The conditions for range validation are as follows:

• Segments must be configured for range validation in pairs, one with thelow value and one with the high value.

• Both segments must be of the same data type.

• Both segments must be parts of the same structure in a key flexfield orparts of the same context in a descriptive flexfield or extensible flexfield.

• The low value segment must have a lower sequence number than the highvalue segment.

• Non-range validated segments can exist between a range validated pair,but range validated pairs cannot overlap or be nested.

You can configure as many range validated pairs as you want within the sameflexfield. Your application automatically detects and applies range validation tothe segment pairs that you define, in sequence order. It must encounter a lowvalue segment first, and the next range validated segment that it encountersmust be a high value segment. These two segments are assumed to be amatching pair. The low value and the high value can be equal.

Rule Validation of Segment Values

Validation rules on descriptive and extensible flexfield segments determine howan attribute is validated. The value entered for an attribute on a business objectmay need to match a specified format or be restricted to a list of values. Use avalue set to specify the validation rules.


Value set validation is required for global segments and context-sensitivesegments, and optional for context segments. In the case of context segments, theapplication may validate an input value instead of the value set validating theinput value against the context segment. However the application input valuesmust match exactly the valid context segment values. If the context segmentvalues are a superset or subset of the input values, you must assign a table-validated value set or independent value set to validate context values.

When you configure a descriptive flexfield segment, you can specify a constantto use for setting the initial value. The initial value can be an available parameter.For every planned segment, list the constant value or parameter, if any, to use forthe initial value.

Naming Conventions

Enter a unique code, name, and description for the segment. These properties arefor internal use and not displayed to end users. You can't change the code afterthe segment is created.

The Application Programming Interface (API) name is a name for the segmentthat isn't exposed to end users. The API name is used to identify the segmentin various integration points including web services, rules, and businessintelligence. Use alphanumeric characters only with a leading character. Forexample, enter a code consisting of the characters A-Z, a-z, 0-9 with a non-numeric leading character. The use of spaces, underscores, multi-byte characters,and leading numeric characters isn't permitted. You can't change the API nameafter the segment has been created.

Flexfields and Value Sets: How They Work Together

Value sets are specific to your enterprise. When gathering information usingflexfields, your enterprise's value sets validate the values that your users enterbased on how you defined the value set.

You can assign a value set to any number of flexfield segments in the same ordifferent flexfields. Value set usage information indicates which flexfields use thevalue set.

The following aspects are important in understanding how flexfields and valuesets work together:

• Defining value sets

• Shared value sets

• Deployment

Defining Value Sets

As a key flexfield guideline, define value sets before configuring the flexfield,because you assign value sets to each segment as you configure a flexfield. Withdescriptive and extensible flexfields, you can define value sets when adding orediting a segment.

Caution


Be sure that changes to a shared value set are compatible with all flexfieldsegments that use the value set.

Shared Value Sets

When you change a value in a shared value set, the change affects the value setfor all flexfields that use that value set. The advantage of a shared value set isthat a single change propagates to all usages. The drawback is that the changeshared across usages may not be appropriate in every case.

Value Set Values

To configure custom attributes to be captured on the value set values screen inthe Manage Value Sets task, configure the Value Set Values descriptive flexfield.The object's code is FND_VS_VALUES_B.This flexfield expects the context codeto correspond to the value set code. For each value set, you can define a contextwhose code is the value set code, and whose context-sensitive segments will beshown for the values of that value set. By default the context segment is hiddensince it defaults to the value set code and is not expected to be changed.

You can also define global segments that will be shown for all value sets.However, this would be quite unusual since it would mean that you want tocapture that attribute for all values for all value sets.

Deployment

When you deploy a flexfield, the value sets assigned to the segments of theflexfield provide end users with the valid values for the attributes represented bythe segments.

Defaulting and Deriving Segment Values: Explained

To populate a flexfield segment with a default value when a row is created,specify a default type of constant or parameter and a default value.

To synchronize a segment's value with another field's value whenever it changes,specify the derivation value to be the flexfield parameter from which to derivethe attribute's value. Whenever the parameter value changes, the attribute'svalue is changed to match. If you derive an attribute from a parameter, considermaking the attribute read-only, as values entered by users are lost whenever theparameter value changes.

When defaulting or deriving a default value from a parameter, only thoseattributes designated by development as parameters are available to be chosen.

Different combinations of making the segments read only or editable incombination with the default or derivation value or both, have different effects.

Initial runtime behavior corresponds to the row for the attribute value beingcreated in the entity table. If the default value is read only, it cannot subsequentlybe changed through the user interface. If the default value isn't read only, userscan modify it. However, if the segment value is a derived value, a user-modifiedsegment value is overwritten when the derivation value changes.


Default Type Default valuespecified?

Derivation valuespecified?

Initial runtimebehavior

Runtime behaviorafter parameterchanges

None No Yes No initial segmentvalue

The changedparameterderivation valueupdates segmentvalue

Constant Yes No Default segmentvalue

N/A

Constant Yes Yes Default segmentvalue


Parameter Yes No The defaultsegment value isthe parameter'sdefault value

N/A

Parameter Yes Yes, and same asdefault value

The defaultsegment value isthe parameter'sdefault andderivation value


Parameter Yes Yes, and differentfrom default value

The defaultsegment value isthe parameter'sdefault value

The changedparameter defaultvalue doesn'tupdate segmentvalue. Only thechanged derivationvalue updates thesegment value.

Flexfield Usages: Explained

Usage affects various aspects of flexfields. The usage of the flexfield is set whenthe flexfield is registered and specifies the application and table with which theflexfield is associated.

Entity usage indicates the table containing the segments of a flexfield.

A flexfield can have multiple usages. The first table registered for a flexfield isthe master usage. Segments are based on the master usage, and other usages ofthe same table for the same flexfield use the same segment setup, though thecolumn names optionally may have a differentiating prefix.

Extensible Flexfields

You can configure different behavior for extensible flexfield contexts at the usagelevel. The usage of an extensible flexfield context determines in which scenariosor user interfaces the segments of a context appear to end users. For example, if aSupplier page displays an extensible flexfield's supplier usage and a buyer pagedisplays that same extensible flexfield's buyer usage, a context that is associated


to the supplier usage but not the buyer usage displays only on the supplier pageand not the buyer page.

Value Sets

The usage of value sets specifies the flexfields having segments where the valueset is assigned.

Flexfield Deployment

Flexfield Deployment: Explained

Deployment generates or refreshes the Application Development Framework(ADF) business component objects that render the flexfield in a user interface.The deployment process adds the custom attributes to the Web ServicesDescription Language (WSDL) schemas that are exposed by Oracle ADF servicesand that are used by SOA composites. Flexfields are deployed for the first timeduring the application provisioning process. After you configure or change aflexfield, you must deploy it to make the latest definition available to end users.

If a descriptive flexfield is enabled for business intelligence, the deploymentprocess redeploys the flexfield's business intelligence artifacts.

You can deploy a flexfield to a sandbox for testing or to the mainline for use in atest or production runtime environment. You can deploy extensible flexfields as abackground process.

After deployment, the custom attributes are available for incorporating into theSOA infrastructure, such as business process and business rule integration. Forexample, you can now write business rules that depend on the custom attributes.You must sign out and sign back in to Oracle Fusion Applications to see thechanges you deployed in the runtime.

The following aspects are important in understanding flexfield deployment:

• Deployment Status

• Initial Deployment Status

• Metadata Validations

• Metadata Synchronization

• Deployment as a Background Process

Deployment Status

Every flexfield has a deployment status.

A flexfield can have the following deployment statuses.

Deployment Status Meaning

Edited The flexfield metadata definition hasn't beendeployed yet. Updates of the metadata definitionaren't applied in the runtime environment yet.


Patched The flexfield metadata definition has been modifiedthrough a patch or through a data migration action,but the flexfield hasn't yet been deployed so theupdated definition isn't reflected in the runtimeenvironment.

Deployed to Sandbox The current metadata for the flexfield is deployedin ADF artifacts and available as a flexfield-enabledsandbox. The status of the sandbox is managedby the Manage Sandboxes task available to theAdministrator menu of the Setup and Maintenancework area.

Deployed The current metadata for the flexfield is deployedin ADF artifacts and available to end users. Therehaven't been any changes to the flexfield since it waslast deployed in the mainline.

Error The deployment attempt in the mainline failed.

Note

Whenever a value set definition changes, the deployment status of a flexfieldthat uses that value set changes to edited. If the change results from a patch, thedeployment status of the flexfield changes to patched.

Initial Deployment Status of Flexfields

The Oracle Fusion Applications installation loads flexfield metadata into thedatabase. This initial load sets the flexfield status to Edited. The applicationprovisioning process during installation deploys the flexfields of the provisionedapplications, which sets their status to Deployed if no errors are encountered.

When accessing a provisioned application, deployed flexfields are ready to use.In some cases, flexfield availability at runtime requires setup, such as definingkey flexfields.

Metadata Validation

Use the Validate Metadata command to view possible metadata errors beforeattempting to deploy the flexfield. Metadata validation is the initial phase of allflexfield deployment commands. By successfully validating metadata beforerunning the deployment commands, you can avoid failures in the metadatavalidation phase of a deployment attempt. The deployment process aborts if itencounters an error during the metadata validation phase. Metadata validationresults don't affect the deployment status of a flexfield.

Metadata Synchronization

When an extensible or descriptive flexfield is deployed, the deploymentprocess regenerates the XML schema definition (XSD), which makes the customattributes available to web services and the SOA infrastructure.


After deploying a flexfield configuration, you must synchronize the updatedXML schema definition (XSD) files in the MDS repositories for each SOAapplication.

Note

To synchronize the updated XSD files in the MDS repositories in Oracle Cloudimplementations, log a service request using My Oracle Support at http://support.com/

Deployment as a Background Process

You can deploy extensible flexfields or incremental changes made to extensibleflexfields as a background process. You must use this action to deploy extensibleflexfields that have more than 30 categories. You can also use this action if youwant to deploy several extensible flexfields, or if you want to continue workingin your session without having to wait for a deployment to complete.

Flexfield Deployment Status: How It Is Calculated

Flexfield deployment status indicates how the flexfield metadata definition inthe Oracle Fusion Applications database relates to the Application DevelopmentFramework (ADF) business components generated into a Metadata Services(MDS) repository.

The following aspects are important in understanding how flexfield deploymentstatus is calculated:

• Settings that affect flexfield deployment status

• How deployment status is calculated

Settings That Affect Flexfield Deployment Status

If you have made a change to a flexfield and expect a changed deploymentstatus, be sure you have saved your changes. No settings affect flexfielddeployment status.

How Deployment Status Is Calculated

If the flexfield definition has been edited through the Define Flexfields activitytask flows, the status is Edited. The latest flexfield metadata definition in theOracle Fusion application diverges from the latest deployed flexfield definition.Any change, including if a value set used in a flexfield changes, changes thedeployment status to Edited. If a flexfield has never been deployed, its status isEdited.

Note

When an application is provisioned, the provisioning framework attempts todeploy all flexfields in that application.

If you deploy the flexfield to a sandbox successfully, the status is Deployed toSandbox. The latest flexfield metadata definition in the Oracle Fusion application


matches the metadata definition that generated ADF business components in asandbox MDS repository. Whether the sandbox is active or not doesn't affect thedeployment status. If the flexfield was deployed to a sandbox and hasn't beenedited or redeployed to the mainline since then, the status remains Deployed toSandbox independent of whether the sandbox is active, or who is viewing thestatus.

If you deploy the flexfield successfully to the mainline, the status is Deployed.The latest flexfield metadata definition in the Oracle Fusion application matchesthe metadata definition that generated ADF business components in a mainlineMDS repository. Change notifications are sent when a flexfield is deployedsuccessfully to the mainline.

If either type of deployment fails so that the current flexfield definition isn'tdeployed, the status is Error. The deployment error message gives details aboutthe error. The latest flexfield metadata definition in the Oracle Fusion applicationlikely diverges from the latest successfully deployed flexfield definition.

If the flexfield definition has been modified by a patch, the status is Patched.The latest flexfield metadata definition in the Oracle Fusion application divergesfrom the latest deployed flexfield definition. If the flexfield definition wasDeployed before the patch and then a patch was applied, the status changes toPatched. If the flexfield definition was Edited before the patch and then a patchwas applied, the status will remain at Edited to reflect that there are still changes(outside of the patch) that aren't yet in effect.

When a deployment attempt fails, you can access the Deployment Error Messagefor details.

Deploying a Flexfield-Enabled Sandbox: How It Works With Mainline Metadata

The flexfield definition in a sandbox corresponds to the flexfield metadatadefinition in the Oracle Fusion Applications database at the time the flexfieldwas deployed to the sandbox. When the flexfield is ready for end users, theflexfield must be deployed to the mainline.

A flexfield-enabled sandbox uses the following components.

• Flexfield metadata in the Oracle Fusion Applications database

• Flexfield business components in a sandbox Metadata Services (MDS)repository

• User interface customizations for the flexfield in the mainline MDSrepository

The figure shows the two types of deployment available in the Manage Flexfieldtasks of the Define Flexfields activity. Deploying a flexfield to a sandbox createsa sandbox MDS repository for the sole purpose of testing flexfield behavior. Thesandbox is only accessible to the administrator who activates and accesses it,not to users generally. Deploying a flexfield to the mainline applies the flexfielddefinition to the mainline MDS repository where it is available to end users.After deploying the flexfield to the mainline, customize the page where theflexfield segments appear. Customization of the page in the sandbox MDSrepository cannot be published to the mainline MDS repository.


Sandbox Metadata Services Repository Data

Deploying the flexfield to a sandbox generates the Application DevelopmentFramework (ADF) business components of a flexfield in a sandbox MDSrepository for testing in isolation.

Warning

Don't customize flexfield segment display properties using Page Composer ina flexfield-enabled sandbox as these changes will be lost when deploying theflexfield to the mainline.

Mainline Metadata Services Repository Data

The Oracle Fusion Applications database stores the single source of truth abouta flexfield. When the flexfield is deployed, the ADF business component objectsthat implement the flexfield in the runtime user interface are generated in themainline MDS repository from this source.

Deploying a Flexfield to a Sandbox: Points to Consider

Deploying a flexfield to a sandbox creates a flexfield-enabled sandbox. Eachflexfield-enabled sandbox contains only one flexfield.


You can test the runtime behavior of a flexfield in the flexfield-enabled sandbox.If changes are needed, you return to the Define Flexfield tasks to change theflexfield definition.

When you deploy a flexfield to sandbox, the process reads the metadata aboutthe segments from the database, generates flexfield Application DevelopmentFramework (ADF) business component artifacts based on that definition, andstores in the sandbox only the generated artifacts derived from the definition.

When you deploy a flexfield sandbox, the process generates the name of theflexfield sandbox, and that flexfield sandbox is set as your current activesandbox. When you next sign in to the application, you can see the updatedflexfield configurations. The Oracle Fusion Applications global area displaysyour current session sandbox.

Note

Unlike a standalone sandbox created using the Manage Sandboxes tool, thesandbox deployed for a flexfield contains only the single flexfield. You canmanage flexfield sandboxes, such as setting an existing flexfield sandbox asactive or deleting it, using the Manage Sandboxes tool.

When you deploy a flexfield to the mainline after having deployed it to thesandbox, the sandbox-enabled flexfield is automatically deleted.

Sandbox MDS Repository Data

The sandbox data lets you test the flexfield in isolation without first deploying itin the mainline where it could be accessed by users.

Warning

Don't customize flexfield segment display properties using Page Composer ina flexfield-enabled sandbox as these changes will be lost when deploying theflexfield to the mainline.

Managing a Flexfield-Enabled Sandbox

When you deploy a flexfield as a sandbox, that flexfield-enabled sandboxautomatically gets activated in your user session. When you sign back in to seethe changes, the sandbox is active in your session.

You can only deploy a flexfield to a sandbox using the Define Flexfields taskflow pages.

You also can use the Manage Sandboxes feature in the Administration menu ofthe Setup and Maintenance work area to activate and access a flexfield-enabledsandbox.

Note

Whether you use the Define Flexfields or Manage Sandboxes task flows to accessa flexfield-enabled sandbox, you must sign out and sign back in before you cansee the changes you deployed in the runtime.


You cannot publish the flexfield from the sandbox to the mainline. You must usethe Define Flexfields task flow pages to deploy the flexfield for access by usersof the mainline because the flexfield configuration in the mainline is the singlesource of truth.

Deploying Flexfields Using the Command Line: Explained

You can use the Manage Key Flexfields, Manage Descriptive Flexfields, andManage Extensible Flexfields tasks to deploy flexfields. You can also useWebLogic Server Tool (WLST) commands for priming the Metadata Services(MDS) repository with predefined flexfield artifacts and for deploying flexfields.

The table describes the available commands.

WebLogic Server Tool Command Description

deployFlexForApp Deploys all flexfields for the specified enterpriseapplication. Only flexfields whose status is otherthan deployed are affected by this command unlessthe option is enabled to force all flexfields to bedeployed regardless of deployment status.

Initial application provisioning runs this commandto prime the MDS repository with flexfield artifacts.

deployFlex Deploy a single flexfield regardless of deploymentstatus

deployPatchedFlex Deploys flexfield changes that have been deliveredusing a flexfield Seed Data Framework (SDF) patch.Deploys flexfields that have a Patched deploymentstatus.

deleteFlexPatchingLabels Displays MDS label of flexfield changes for viewingand deleting patching labels.

validateFlexDeploymentStatus Displays list containing flexfields that aren'tdeployed or failed deployment.

Executing these commands outputs a report at the command line. The reportprovides the following information for every flexfield that is processed.

• Application identity (APPID)

• Flexfield code

• Deployment result, such as success or error

In case of errors, the report lists the usages for which the errors wereencountered. If a runtime exception occurs, the output displays the tracebackinformation. For each WLST flexfield command, adding the reportFormat='xml'argument returns the report as an XML string.

Consider the following aspects of command line deployment.

• Preparing to use the WLST flexfield commands

• Using the deployFlexForApp command

• Using the deployFlex command


• Using the deployPatchedFlex command

• Using the deleteFlexPatchingLabels command

• Using the validateFlexDeploymentStatus command

• Exiting the WLST and checking the results

Preparing To Use the WLST Flexfield Commands

You can only execute the WLST flexfield commands on a WebLogicAdministration Server for a domain that has a running instance of the OracleFusion Middleware Extensions for Applications (Applications Core) Setupapplication.

For more information on deploying the Applications Core Setup application, seethe Oracle Fusion Applications Developer's Guide.

Ensure that the AppMasterDB data source is registered as a JDBC data sourcewith the WebLogic Administration Server and points to the same database as theApplicationDB data source.

Start the WebLogic Server Tool (WLST) if it isn't currently running.

UNIX:

sh $JDEV_HOME/oracle_common/common/bin/wlst.sh

Windows:

wlst.cmd

Connect to the server, replacing the user name and password arguments withyour WebLogic Server user name and password.

connect('wls_username', 'wls_password', 'wls_uri')

The values must be wrapped in single-quotes. The wls_uri value is typicallyT3://localhost:7101.

For more information on the WLST scripting tool, see the Oracle FusionMiddleware Oracle WebLogic Scripting Tool.

Using the deployFlexForApp Command

The deployFlexForApp command translates the product application's predefinedflexfield metadata into artifacts in the MDS repository.

Important

This command is run automatically when you provision applications. However,after custom applications development, you must run the deployFlexForAppcommand after you configure your application to read the flexfield artifacts fromthe MDS repository and before you log into the application for the first time,even if there is no predefined flexfield metadata.

This command doesn't deploy flexfields that have a status of Deployed unlessthe force parameter is set to 'true' (the default setting is 'false').


For more information on priming the MDS partition with configured flexfieldartifacts, see the Oracle Fusion Applications Developer's Guide.

From the WLST tool, execute the following commands to deploy the artifactsto the MDS partition, replacing product_application_shortname with theapplication's short name wrapped in single-quotes.

deployFlexForApp('product_application_shortname'[, 'enterprise_id'] [,'force'])

In a multi-tenant environment, replace enterprise_id with the Enterprise ID towhich the flexfield is mapped. Otherwise, replace with 'None' or don't provide asecond argument.

To deploy all flexfields regardless of their deployment status, set force to 'true'(the default setting is 'false'). If you want to deploy all flexfields in a single-tenant environment, you either can set enterprise_id to 'None', or you can usethe following signature:

deployFlexForApp(applicationShortName='product_application_shortname',force='true')

Tip

The application's short name is the same as the application's module name.

For more information about working with application taxonomy, see the OracleFusion Applications Developer's Guide.

Using the deployFlex Command

From the WLST tool, execute the following command to deploy a flexfield,replacing flex_code with the code that identifies the flexfield, and replacingflex_type with the flexfield's type, which is either DFF, KFF, or EFF.

deployFlex('flex_code', 'flex_type')

The values must be wrapped in single-quotes.

Using the deployPatchedFlex Command

Use the deployPatchedFlex command for situations where the patchingframework doesn't invoke the command, such as when an application has beenpatched offline.

If the installation is multi-tenant enabled, the command deploys all patchedflexfields for all enterprises. This command isn't intended to be invokedmanually.

Check with your provisioning or patching team, or the task flows for managingflexfields, to verify that the flexfield has a Patched deployment status.

From the WLST tool, execute the following command to deploy the artifacts tothe MDS partition.

deployPatchedFlex()

Execute the following command to deploy all flexfields that have either aREADY status or an ERROR status.

deployPatchedFlex(mode='RETRY')


Using the deleteFlexPatchingLabels Command

Whenever you deploy flexfield changes to MDS using thedeployPatchedFlex() WLST command, an MDS label is created in the formatFlexPatchingWatermarkdate+time. Use the deleteFlexPatchingLabels command toinquire about and delete these labels.

From the WLST tool, execute the deleteFlexPatchingLabels () command withno arguments to delete the flexfield patching labels.

To output a list of flexfield patching labels, execute the command with theinfoOnly argument, as follows:

deleteFlexPatchingLabels(infoOnly='true')

Using the validateFlexDeploymentStatus Command

The validateFlexDeploymentStatus() WLST command checks the deploymentstatus of all flexfields in an Oracle Fusion Applications deployment.

validateFlexDeploymentStatus()

Use this command to verify that all flexfields in the current instance ofprovisioned Java EE applications are deployed.

Exiting the WLST and Checking the Results

To exit the tool, execute the following command.

disconnect()

Optionally, sign into the application, access user interface pages that containflexfields, and confirm the presence of flexfields for which configuration exists,such as value sets, segments, context, or structures.

Manage Value Sets

Value Sets: Explained

A value set is a group of valid values that you assign to a flexfield segment tocontrol the values that are stored for business object attributes..

An end user enters a value for an attribute of a business object while using theapplication. The flexfield validates the value against the set of valid values thatyou configured as a value set and assigned to the segment.

For example, you can define a required format, such as a five digit number, or alist of valid values, such as green, red, and blue.

Flexfield segments are usually validated, and typically each segment in a givenflexfield uses a different value set. You can assign a single value set to more thanone segment, and you can share value sets among different flexfields.

Caution

Be sure that changes to a shared value set are compatible with all flexfieldssegments using the value set.


The following aspects are important in understanding value sets:

• Managing value sets

• Validation

• Security

• Precision and scale

• Usage and deployment

Managing Value Sets

To access the Manage Value Sets page, use the Manage Value Sets task, or usethe Manage Descriptive Flexfields and Manage Extensible Flexfields tasks forconfiguring a segment, including its value set. To access the Manage Valuespage, select the value set from the Manage Value Sets page, and click ManageValues. Alternatively, click Manage Values from the Edit Value Set page.

Validation

The following types of validation are available for value sets:

• Format only, where end users enter data rather than selecting values froma list

• Independent, a list of values consisting of valid values you specify

• Dependent, a list of values where a valid value derives from theindependent value of another segment

• Subset, where the list of values is a subset of the values in an existingindependent value set

• Table, where the values derive from a column in an application table andthe list of values is limited by a WHERE clause

A segment that uses a format only value set doesn't present a list of valid valuesto users.

Note

Adding table validated value sets to the list of available value sets available forconfiguration is considered a custom task.

Security

Value set security only works in conjunction with usage within flexfieldsegments.

You can specify that data security be applied to the values in flexfield segmentsthat use a value set. Based on the roles provisioned to users, data securitypolicies determine which values of the flexfield segment end users can view ormodify.

Value set security applies at the value set level. The value set is the resourcesecured by data security policies. If a value set is secured, every usage of it in anyflexfield is secured. It isn't possible to disable security for individual usages ofthe same value set.


Value set security applies to independent, dependent, or table-validated valuesets.

Value set security applies mainly when data is being created or updated, and tokey flexfield combinations tables for query purposes. Value set security doesn'tdetermine which descriptive flexfield data is shown upon querying.

Security conditions defined on value sets always use table aliases. When filtersare used, table aliases are always used by default. When predicates are definedfor data security conditions, make sure that the predicates also use table aliases.

For key flexfields, the attributes in the view object that correspond to the codecombination ID (CCID), structure instance number (SIN), and data set number(DSN) cannot be transient. They must exist in the database table. For keyflexfields, the SIN segment is the discriminator attribute, and the CCID segmentis the common attribute.

Precision and Scale

If the data type of a value set is Number, you can specify the precision(maximum number of digits user can enter) or scale (maximum number of digitsfollowing the decimal point).

Usage and Deployment

The usage of a value set is the flexfields where that value set is used. Thedeployment status of flexfields in which the value set is used indicates thedeployment status of the value set instance.

The figure shows a value set used by a segment in a key flexfield and the contextsegment of a descriptive flexfield.


For most value sets, when you enter values into a flexfield segment, you canenter only values that already exist in the value set assigned to that segment.

Global and context-sensitive segment require a value set. You can assign a valueset to a descriptive flexfield context segment. If you specify only context values,not value sets for contexts, the set of valid values is equal to the set of contextvalues.

Defining Value Sets: Critical Choices

Validation and usage of value sets determine where and how end users accessvalid values for attributes represented by flexfield segments.

Tip

As a flexfield guideline, define value sets before configuring the flexfield,because you can assign value sets to each segment as you configure a flexfield.With descriptive and extensible flexfield segments, you can create value setswhen adding or editing a segment on the runtime page where the flexfieldappears.

The following aspects are important in defining value sets:

• Value sets for context segments

• Format-only validation

• Interdependent value sets

• Table validation

• Range

• Security

• Testing and maintenance

Value Sets for Context Segments

When assigning a value set to a context segment, you can only use table-validated or independent value sets.

You can use only table and independent value sets to validate context values.The data type must be character and the maximum length of the values beingstored must not be larger than the context's column length. If you use a tablevalue set, the value set cannot reference flexfield segments in the value set'sWHERE clause other than the flexfield segment to which the value set isassigned.

Format Only Validation

The format only validation type enables end users to enter any value, as longas it meets your specified formatting rules. That is, the value must not exceedthe maximum length you define for your value set, and it must meet any formatrequirements for that value set.


For example, if the value set allows only numeric characters, users can enter thevalue 456 (for a value set with maximum length of three or more), but can't enterthe value ABC. A format only value set doesn't otherwise restrict the range ofdifferent values that users can enter. For numeric values, you can also specify ifa numeric value should be zero filled or how may digits should follow the radixseparator.

Interdependent Value Sets

Use an independent value set to validate input against a list that isn't storedin an application table, and not dependent on a subset of another independentvalue set.

You cannot specify a dependent value set for a given segment without havingfirst defined an independent value set that you apply to another segment inthe same flexfield. Use a dependent value set to limit the list of values for agiven segment based on the value that the end user has chosen for a relatedindependent segment. The available values in a dependent list and the meaningof a given value depend on which value was selected for the independentlyvalidated segment.

For example, you could define an independent value set of U.S. states withvalues such as CA, NY, and so on. Then you define a dependent value set of U.S.cities, with values such as San Francisco and Los Angeles that are valid for theindependent value CA, and New York City and Albany that are valid for theindependent value NY. In the UI, only the valid cities can be selected for a givenstate.

Because you define a subset value set from an existing independent value set,you must define the independent value set first. End users don't need to choose avalue for another segment first to have access to the subset value set.

Independent, dependent, and subset value sets require a customized list of validvalues. Use the Manage Values page to create and manage a value set's validvalues and the order in which they appear.

Tip

You can customize the Manage Value Sets page to capture additional attributesfor each valid value by adding context-sensitive segments in a new context forFND_VS_VALUES_B descriptive field.

Table Validation

Typically, you use a table-validated set when the values you want to use arealready maintained in an application table, such as a table of vendor names.Specify the table column that contains the valid value. You can optionally specifythe description and ID columns, a WHERE clause to limit the values to use foryour set, and an ORDER BY clause.

If you specify an ID column, then the flexfield saves the ID value, instead ofthe value from the value column, in the associated flexfield segment. If theunderlying table supports translations, you can enable the display of translatedtext by basing the value set's value column on a translated attribute of the


underlying table. You should also define an ID column that is based on anattribute that isn't language-dependent so that the value's invariant ID (an IDthat doesn't change) is saved in the transaction table. This allows the runtime todisplay the corresponding translated text from the value column for the runtimesession's locale.

Table validation lets you enable a segment to depend upon multiple priorsegments in the same context structure. You cannot reference other flexfieldsegments in the table-validated value set's WHERE clause. That is, the WHEREclause cannot reference SEGMENT.segment_code or VALUESET.value_set_code.

Table-validated value sets have unique values across the table, irrespective ofbind variables. The WHERE clause fragment of the value set is considered if itdoesn't have bind variables. If it has bind variables, the assumption is that thevalues are unique in the value set.

Range

In the case of format, independent, or dependent value sets, you can specify arange to further limit which values are valid. You can specify a range of valuesthat are valid within a value set. You can also specify a range validated pair ofsegments where one segment represents the low end of the range and anothersegment represents the high end of the range.

For example, you might specify a range for a format-only value set with formattype Number where the user can enter only values between 0 and 100.

Security

In the case of independent and dependent values, you can specify that datasecurity be applied to the values in segments that use a value set. Based on theroles provisioned to users, data security policies determine which values of theflexfield segment end users can view or modify.

To enable security on a value set, specify a database resource, typically the codevalue for the value set. Using the Manage Database Security Policies task, specifyconditions, such as filters or SQL predicates, and policies that associate roleswith conditions. You can use a filter for simple conditions. For more complexconditions, use a SQL predicate.

Value set data security policies and conditions differ from data securityconditions and policies for business objects in the following ways:

• You can grant only read access to end users. You cannot specify any otheraction.

• When defining a condition that is based on a SQL predicate, use VALUE,VALUE_NUMBER, VALUE_DATE, VALUE_TIMESTAMP, or VALUE_IDto reference the value from a dependent, independent, or subset valueset. For table value sets, use a table alias to define the table, such as&TABLE_ALIAS category=70.

When you enable security on table-validated value sets, the security rule that isdefined is absolute and not contingent upon the bind variables (if any) that maybe used by the WHERE clause of the value set. For example, suppose a table-


validated value set has a bind variable to further filter the value list to x, y and zfrom a list of x, y, z, xx, yy, zz. The data security rule or filter written against thevalue set shouldn't assume anything about the bind variables; it must assumethat the whole list of values is available and write the rule, for example, to allowx, or to allow y and z. By default in data security, all values are denied and showonly rows to which access has been provided.

Testing and Maintenance

There is no need to define or maintain values for a table-validated value set, asthe values are managed as part of the referenced table or independent value set,respectively.

You cannot manage value sets in a sandbox.

When you change an existing value set, the deployment status for all affectedflexfields changes to Edited. You must redeploy all flexfields that use that valueset to make the flexfields reflect the changes. In the UI pages for managing valuesets, the value set's usages show which flexfields are affected by the value setchanges.

If your application has more than one language installed, or there is anypossibility that you might install one or more additional languages for yourapplication in the future, select Translatable. This doesn't require you to providetranslated values now, but you cannot change this option if you decide toprovide them later.

Manage Descriptive Flexfields

Descriptive Flexfields: Explained

Descriptive flexfields provide a way to add custom attributes to entities, anddefine validation and display properties for them. These attributes are generallystandalone. They don't necessarily have anything to do with each other andaren't treated together as a combination.

All Oracle Fusion Applications business entities that you can access are enabledfor descriptive flexfields. Descriptive flexfields are optional. You can choosewhether or not to configure and expose segments for the descriptive flexfielddefined and registered in your database. For lists of descriptive flexfields, seeassets with the Flexfield: Descriptive type in Oracle Enterprise Repository forOracle Fusion Applications (http://fusionappsoer.oracle.com).

A descriptive flexfield provides a set amount of segments for an entity. You makethe segments of a descriptive flexfield available to end users as individual fieldsin the application user interface.

Context

A descriptive flexfield can have only one context segment to provide contextsensitivity.


The same underlying column can be used by different segments in differentcontexts. For example, you can define a Dimensions context that uses theATTRIBUTE1 column for height, the ATTRIBUTE2 column for width, and theATTRIBUTE3 column for depth. You can also define a Measurements contextthat uses the same columns for other attributes: the ATTRIBUTE1 column forweight, the ATTRIBUTE2 column for volume, and the ATTRIBUTE3 column fordensity.

Segments and Contexts

Descriptive flexfield segments are of the following types.

Segment Type Runtime Behavior

Global segment Always available

Context segment Determines which context-sensitive segments aredisplayed

Context-sensitive segment Displayed depending on the value of the contextsegment

In the figure, a descriptive flexfield has one context segment called Category forwhich there are three values: Resistor, Battery, and Capacitor. In addition, thedescriptive flexfield consists of two global segments that appear in each of thecontexts, and three context-sensitive segments that only appear in the context inwhich they are configured.

Application development determines the number of segments available forconfiguring. During implementation, you configure the flexfield by determiningthe following:

• Which attributes to add using the available segments

• The context values


• The combination of attributes in each context

A segment can be used for different attributes, such as Height in Context1and Color in Context2. Each segment of a descriptive flexfield that you makeavailable to end users is exposed in the user interface as an individual field.

Value Sets

For each global and context-sensitive segment, you configure the values allowedfor the segment and how the values that end users enter are validated, includinginterdependent validation among the segments.

Managing Descriptive Flexfields: Points to Consider

Configuring descriptive flexfields involves managing the available flexfieldsregistered with your Oracle Fusion Applications database and configuring theirflexfield-level properties, defining and managing descriptive flexfield contexts,and configuring global and context-sensitive segments.

Every descriptive flexfield is registered to include a context segment, which youmay choose to use or not.

In general, configuring descriptive flexfields involves:

1. Creating segment labels for business intelligence enabled flexfields.

2. Configuring global segments by providing identity information, the initialdefault value, and the display properties.

3. Configuring the context segment by specifying the prompt, whether thecontext segment should be displayed, and whether a value is required.

4. Configuring contexts by specifying a context code, description, and namefor each context value, and adding its context-sensitive segments, eachof which is configured to include identifying information, the columnassignment, the initial default value, and the display properties.

The following aspects are important in understanding descriptive flexfieldmanagement:

• Segments

• Adding Segments to a Highlighted Flexfield

• Usages

• Parameters

• Delimiters

• Initial Values

• Business Intelligence

Segments

You can assign sequence order numbers to global segments and to context-sensitive segments in each context. Segment display is always in a fixed order.


You cannot enter a number for one segment that is already in use for a differentsegment.

Value sets are optional for context segments. The value set that you specify for acontext segment consists of a set of context codes, each of which corresponds toa context that is appropriate for the descriptive flexfield. The value set must beindependent or table-validated. If table-validated, the WHERE clause must notuse the VALUESET.value_set_code or SEGMENT.segment_code bind variables.The value set must be of data type Character with the maximum length of valuesbeing stored no larger than the context's column length.

If you don't specify a value set for a context segment, the valid values for thatcontext segment are derived from the context codes. The definition of eachcontext segment specifies the set of context-sensitive segments that can bepresented when that context code is selected by the end user.

For reasons of data integrity, you cannot delete an existing context. Instead, youcan disable the associated context value in its own value set by setting its enddate to a date in the past.

You can configure the individual global segments and context-sensitive segmentsin a descriptive flexfield. These segment types are differentiated by theirusage, but they are configured on application pages that use most of the sameproperties.

Adding Segments to a Highlighted Flexfield

When you highlight flexfields on a runtime page and use an Add Segment iconbutton to create a segment, the segment code, name, description, table column,and sequence number are set automatically. If you use an Add Segment iconbutton to configure descriptive flexfield segments, you cannot use an existingvalue set. Value sets are created automatically when you add the segments. Youcan enter the valid values, their descriptions, and the default value or specify theformatting constraints for the value set, such as minimum and maximum values.

Depending on display type, the value set you create with the Add Segmenticon button is either an independent value set or a format-only value set. Thetable shows which type of value set is created depending on the segment displaycomponent you select.

Display Component Value Set Created with Add Segment

Check box Independent

Drop-down list Independent

List of Values Independent

Radio Button Group Independent

Text Field With Search Independent

Text box Format Only

Text area Format Only

Date/Time Format Only

Tip


After you add a context value, refresh the page to see the new value.

Usages

Descriptive flexfield usages allow for the same definition to be appliedto multiple entities or application tables, such as a USER table and aUSER_HISTORY table. Descriptive flexfield tables define the placeholder entitywhere the flexfield segment values are stored once you have configured thedescriptive flexfield. When you configure a flexfield, the configuration applies toall its usages.

Parameters

Some descriptive flexfields provide parameters, which are attributes of thesame or related entity objects. Parameters are public arguments to a descriptiveflexfield. Parameters provide outside values in descriptive flexfield validation.You use parameters to set the initial value or derivation value of an attributefrom external reference data, such as a column value or a session variable, ratherthan from user input. Parameters can be referenced by the logic that derives thedefault segment value, and by table-validated value set WHERE clauses.

Delimiters

A segment delimiter or separator visually separates segment values when theflexfield is displayed as a string of concatenated segments.

Initial Values

The SQL statement defining an initial value must be a valid statement thatreturns only one row and a value of the correct type.

You can use two types of SQL statements:

• SQL statement with no binding. For example, select MIN(SALARY) fromEMPLOYEES.

• SQL statement with bind variables. You can use the following bindvariables in the WHERE clause of the SQL statement.

• :{SEGMENT.<segment_code>}: Identifies a segment in the same context.

• :{CONTEXT.<context_code>;SEGMENT.<segment_code>}: Identifiesa segment in a different context. The context must be in the samecategory or in an ancestor category, and it cannot be a multiple-rowcontext.

• :{VALUESET.<value_set_code>}: Identifies the closest prior segment inthe same context that is assigned to the specified value set.

• :{FLEXFIELD.<internal_code>}: Identifies a flexfield.

For more information about using bind variables, see the help for value sets.


Business Intelligence

Selecting a global, context, or context-sensitive segment's BI Enabled checkboxspecifies that the segment is available for use in Oracle Business Intelligence.

When the flexfield is imported into Oracle Business Intelligence, the label youselected from the BI Label dropdown list equalizes the segment with segmentsin other contexts, and maps the segment to the logical object represented by thelabel.

Enabling Descriptive Flexfield Segments for Business Intelligence: Points to

Consider

A descriptive flexfield that is registered in the database as enabled for OracleBusiness Intelligence (BI) includes a BI Enabled setting for each of its segments.When a global, context, or context-sensitive segment is BI-enabled, it is availablefor use in Oracle Business Intelligence.

The following aspects are important in understanding BI-enabled flexfieldsegments:

• Flattening business components to use BI-enabled segments in Oracle BI

• Equalizing segments to prevent duplication and complexity in theflattened component

• Mapping attributes of flattened business components to logical objects inOracle BI

• Managing the labels that map segments to logical objects in Oracle BI

After you deploy a business intelligence-enabled flexfield, use the Import OracleFusion Data Extensions for Transactional Business Intelligence process to importthe flexfield changes into the Oracle Business Intelligence repository. Users canmake use of the newly-generated attributes in business intelligence applications.For example, a user can generate a report that includes attributes added by thedescriptive flexfield. For additional information about logical objects and import,refer to the Oracle Transactional Business Intelligence Administrator's Guide.

Flattening

When you deploy a business intelligence-enabled descriptive flexfield, thedeployment process generates an additional set of flattened ApplicationDevelopment Framework (ADF) business components in addition to theusual ADF business components and ADF faces runtime artifacts that aregenerated during deployment. The flattened business components includeattributes for business intelligence-enabled segments only. Flattening means eachcustom column in each context shows up as an attribute in an Oracle BusinessIntelligence folder.

Flattened components include one attribute for the BI-enabled context-segment,and one attribute for each business intelligence-enabled global segment. For BI-enabled context-sensitive segments, consider the following:


• If you assigned a label to the segment, the flattened components includean additional single attribute representing segments with that label.

• If you didn't assign a label, the flattened components include a discreteattribute for each BI-enabled context-sensitive segment in each context.

Mapping to Logical Objects in Business Intelligence

You can simplify reporting by representing similar segments as a single logicalobject in Business Intelligence.

If you assign a label to any set of context-sensitive segments that serve the samepurpose in different contexts, you can consolidate or equalize the segmentsinto a single attribute. This prevents duplication and the extra workload andcomplexity that result from the flattening process. For example, a United Statescontext might have a Passport segment and a Canada context might have Visasegment. If you assign the NationalID segment label to both the Passport andVisa segments, they are equalized into the same NationalID attribute in theflattened business component.

Non-labeled context-sensitive segments aren't equalized across context values, sothe flattened components include a separate attribute for each context-sensitivesegment for each context value.

Note

It may not be possible to equalize similarly labeled segments if they haveincompatible data types or value set types.

Assign a label to a global segment, context segment, or context-sensitive segmentto map the corresponding attribute in the flattened components to a logicalobject in Oracle Business Intelligence. Using labels to map segments to BI logicalobjects minimizes the steps for importing the flexfield into Oracle BusinessIntelligence.

Note

Assigning a label to a context-sensitive segment serves to equalize the attributeacross contexts, as well as map the equalized attribute to business intelligence.

Managing Labels

You may assign a predefined label (if available) to segments or create new labelsfor assignment, as needed. Specify a code, name, and description to identifyeach label. In the BI Object Name field, enter the name of the logical object inOracle Business Intelligence to which the segment label should map duringimport. Specifying the BI logical object minimizes the steps for importing theflexfield into Oracle Business Intelligence and helps to equalize context-sensitivesegments across contexts.

If no labels are assigned to a BI-enabled segment, or the BI Object Name on theassigned label doesn't exist in business intelligence, you must manually mapthe segment to the desired logical object when importing into Oracle BusinessIntelligence.


In addition, context-sensitive segments without labels cannot be equalized acrosscontext values. The flattened components include a separate attribute for eachnon-labeled context-sensitive segment in each context.

Importing to Oracle Business Intelligence Repository

After you deploy a business intelligence-enabled flexfield, import the flexfieldchanges into the Oracle Business Intelligence repository to make use ofthe newly flattened business components in business intelligence and thenpropagate the flexfield object changes. When you import the metadatainto the Oracle Business Intelligence repository, you must do so as theFUSION_APPS_BI_APPID user.

Note

To import flexfield changes into the Oracle Business Intelligence repository inOracle Cloud implementations, run the Import Oracle Fusion Data Extensionsfor Transactional Business Intelligence process. For additional information aboutimport, refer to the Oracle Transactional Business Intelligence Administrator'sGuide.

Tip

When you import a flexfield into the Oracle Business Intelligence repository,you see both <name>_ and <name>_c attributes for each segment, along with someother optional attributes. The <name> attribute contains the value. The <name>_cattribute contains the code of the value set that the value comes from, and is usedfor linking to the value dimension. You must import both attributes.

FAQs for Define Flexfields

Why did my flexfield changes not appear in the runtime UI?

The ADF business components or artifacts of a flexfield, which are generatedinto an metadata services (MDS) repository when the flexfield is deployed, arecached within a user session. You must sign out and sign back in again to viewflexfield definition changes reflected in the runtime application user interfacepage.

A flexfield's deployment status indicates whether the flexfield segments ascurrently defined in the metadata are available to end users. The flexfieldsegments seen by end users in the runtime correspond to the flexfield definitionthat was last deployed successfully.

What happens if a value set is security enabled?

Value set security is a feature that enables you to secure access to value set valuesbased on the end user's role in the system.

As an example, suppose you have a value set of US state names. When this valueset is used to validate a flexfield segment, and users can select a value for the


segment, you can use value set security to restrict them to selecting only a certainstate or subset of states based on their assigned roles in the system.

For example, Western-region employees may choose only California, Nevada,Oregon, and so on as valid values. They cannot select non-Western-region states.Eastern-region employees may choose only New York, New Jersey, Virginia,and so on as valid values, but cannot select non-Eastern-region states. Value setsecurity is implemented using Oracle Fusion Applications data security.

How can I set a default value for a flexfield segment?

When you define or edit a flexfield segment, you specify a default value from thevalues provided by the value set assigned to that segment.

You can set the default value for a descriptive flexfield segment to be aparameter, which means the entity object attribute to which the chosenparameter is mapped provides the initial default value for the segment.

You can set the default value to be a constant, if appropriate to the data type ofthe value set assigned to the segment.

In addition to an initial default value, you can set a derivation value for updatingthe attribute's value every time the parameter value changes. The parameter youchoose identifies the entity object source attribute. Any changes in the value ofthe source attribute during runtime are reflected in the value of the segment.

If the display type of the segment is a check box, you can set whether the defaultvalue of the segment is checked or unchecked.

Define Attachments

Attachments: Explained

Attachments are pieces of supplementary information that users can associatewith specific business objects such as expense reports or purchase orders.Attachments can be URLs, desktop files, text, or in cases where available,repository folders. For any given business object, a user may be able to only viewattachments, or also create, delete, or edit attachments, depending on security.For more information on an introduction to attachments, see the Oracle FusionApplications Developer's Guide.

Repository

Attachments are stored in a content management repository provided by OracleWebCenter Content Server. Users managing attachments have no real interactionwith the repository unless the repository mode is enabled for attachments onspecific business objects. In that case, users can share attachments among objects,update attachments by checking them out of and back into the repository,and perform other tasks. Access to attachment files is controlled by a digital


signing mechanism. Depending on security, users might have direct access to therepository.

Security

Data security that applies to a specific business object also applies to attachmentsfor that object, as determined by the attachment entity defined for the object. Forexample, if a user has no access to a specific expense report, then the same usercannot access attachments for the expense report. You can also use attachmentcategories to control access and actions on attachments, based on roles associatedwith the category. For more information on securing attachments, see the OracleFusion Applications Developer's Guide.

Attachment Entities: Explained

An attachment entity is usually a database entity, for example a table or view,that represents a business object attachments can be associated with. Eachattachment UI must be defined with a corresponding attachment entity, whichnot only identifies the business object to attach to, but also controls what userscan do. Attachment entities are used only in the context of attachments and existseparately from the database entities that they are based on.

Edit and create attachment entities on the Manage Attachment Entities page,which you can access by starting in the Setup and Maintenance Overview pageand searching for the Manage Attachment Entities task. Though you wouldgenerally use predefined attachment entities with attachment UIs, you mightneed to create new entities, for example when developing custom UIs.

Entity Names

An attachment entity name should match the name of the table or viewthat represents the business object to attach to. The name is also used in therepository folder that is automatically created to store attachments for the entity.The attachment entity display name should be something that users know torepresent the business object.

Database Resource

The data security policies associated with the database resource defined for theattachment entity would apply to attachments for that entity. For example, basedon the database resource for the expense reports attachment entity, the samepolicies apply to attachments for expense reports. The database resource valuemust match the value in the OBJ_NAME column in the FND_OBJECTS table forthe business object that the entity represents.

Enabling Security

Security based on the database resource associated with the attachment entity isalways in effect. What you can enable or disable is security based on attachment


categories. If any of the attachment categories associated with the attachmententity has data security defined, then that security applies to this entity only ifenabled.

Attachment Entities and Attachment Categories: How They Work Together

The association between attachment entities and categories determines whichcategories can be used for an entity. For example, categories associated with theexpense report attachment entity are available to be implemented in attachmentUIs for expense reports. You can define these associations when managing eitherentities or categories. Any association changes in either the Manage AttachmentEntities or Manage Attachment Categories page are reflected on the other page.You can access either page by starting in the Setup and Maintenance Overviewpage and searching for attachment tasks.

Managing Entities

You determine which attachment categories are relevant to a particular entityon the Manage Attachment Entities page, and each entity must have at least onecategory. Depending on configuration, any or all of the available categories forthat entity are used. For example, you assign three categories to the expensereports attachment entity. For a particular expense report page with attachmentsfunctionality, you can customize the attachments component to specify which ofthe three categories are used. Based on your selection, the data security definedfor each category, if any, is applied to attachments on that page if the attachmententity has category-based security enabled.

Managing Categories

If you create an attachment category and need to assign it to multiple attachmententities, use the Manage Attachment Categories page. The association means thesame as the association on the Manage Attachment Entities page.

Attachments Troubleshooting: Explained

Attachments UIs for users to add and manage attachments are fully functional asis, and users usually would not encounter issues. If you customize attachmentsin any way, for example by creating additional attachment categories andimplementing data security on them, then some issues might arise.

Issue: Unable to View, Add, Update, or Delete Attachments

Users encounter issues when trying to view attachments or perform actions suchas adding attachments.

• Users can no longer see specific attachments that they were previouslyable to see.

• Likewise, they can no longer update or delete attachments.

• Users get an error stating that they do not have permission to addattachments.


Resolution

Use the Manage Attachment Entities page to ensure that attachment categoriesare associated to the relevant attachment entity. For example, if users can nolonger see attachments for an expense report, then search for the expense reportattachment entity and assign all necessary categories to it. You might need tocheck with your system administrator or help desk to determine the exact entityused on the page with the expenses attachments or what categories to assign.

If data security is implemented on the categories for the attachment entity, thenverify that the Enable Security check box is selected in the Manage AttachmentEntities page for that entity. Make sure that users have a role with the privilegesshown in the following table, to view, add, update, or delete attachments with aspecific attachment category.

Action Privilege

View Read Application Attachment(FND_READ_APPLICATION_ATTACHMENT_DATA)

Add or Update Update Application Attachment(FND_UPDATE_APPLICATION_ATTACHMENT_DATA)

Delete Delete Application Attachment(FND_DELETE_APPLICATION_ATTACHMENT_DATA)

For example, if users have the Read Application Attachment privilege for allcategories associated with the expense report attachment entity, except theReceipts attachment category, then they can view all expense report attachmentsexcept those created with the Receipts category. Likewise, if users do not havethe Update Application Attachment privilege for any attachment categories tiedto the expense report attachment entity, then they cannot create any attachmentsat all for expense reports.

For more information on attachment category data security, see the OracleFusion Applications Developer's Guide.

Finally, certain attachments UI for users have predefined restrictions oncategories in place. Your developers can also introduce additional filters todetermine which document categories are available for a specific page. Checkwith your developers or help desk.

Issue: Missing Attachment Category

Users can see existing attachments, but the attachments no longer have anattachment category value.

Resolution

When the attachment was added, at least one category existed for thecorresponding attachment entity, as otherwise the attachment could not havebeen added. Since then, the entity was edited so that it no longer has anyassigned categories, so the user cannot see the category associated with thatattachment.


Use the Manage Attachment Entities page to reassign attachment categoriesto the relevant attachment entity. For example, if users can no longer see theReceipts attachment category for an attachment to an expense report, thensearch for the expense report attachment entity and assign to it the Receiptscategory. You might need to check with your system administrator or help deskto determine the exact entity used on the page with the expenses attachments orwhat additional categories to assign.

Finally, certain attachments UI for users have predefined restrictions oncategories in place. Your developers can also introduce additional filters todetermine which document categories are available for a specific page. Checkwith your developers or help desk.

FAQs for Define Attachments

What's an attachment category?

An attachment category is used to classify and secure attachments. Eachattachment user interface must be defined with at least one category for usersto be able to add attachments. If there are multiple categories, users can viewthem and select one when adding attachments. For example, attachments for anexpense report can be categorized as receipts, scanned invoice images, and so on.

You can also associate roles with categories to determine user access and actionsfor attachments, based on the categories assigned to the attachment entity. Forexample, security for expense report attachments can be based in part on thecategories assigned to the expense report attachment entity. You can definemultiple categories per module, and add and manage custom categories for yourown purposes. For more information on attachment category data security, seethe Oracle Fusion Applications Developer's Guide.

Use the Manage Attachment Categories page, which you can access by startingin the Setup and Maintenance Overview page and searching for the ManageAttachment Categories task.

Define Transactional Business Intelligence Configuration for Product Management 11-1

11Define Transactional Business

Intelligence Configuration for ProductManagement

Define Transactional Business Intelligence Configuration

Define Transactional Business Intelligence Configuration: Highlights

Configure Oracle Transactional Business Intelligence for ad hoc reporting, reviewcertain setup objects to be used in Transactional Business Intelligence, andmanage the presentation catalog and currency type display.

Defining Transactional Business Intelligence Configuration

• Review details about the Transactional Business Intelligence tasks. Referto the Oracle Fusion Transactional Business Intelligence Administrator'sGuide.

Access to Person Data

Assigning Security Profiles to Job Roles for Oracle Fusion Transactional

Business Intelligence Users: Explained

Users of Oracle Fusion Transactional Business Intelligence (TransactionalBusiness Intelligence) need access to some person data for reporting purposes.To provide this access, you assign a predefined security profile to relevant jobor abstract roles using the Oracle Fusion Human Capital Management (HCM)setup task Manage Data Role and Security Profiles. On completion of this task,Oracle Fusion Data Security is updated automatically for roles being used toaccess Transactional Business Intelligence.

Job or Abstract Roles and Related Security Profiles

The following table identifies, by Oracle Fusion product, the job and abstractroles that need access to person data and the predefined security profile that youassign to each role.


Product Job or Abstract Role Security Profile

Oracle Fusion Assets Asset Accountant View All Workers

Oracle Fusion Assets Asset Accounting Manager View All Workers

Oracle Fusion Enterprise Planningand Budgeting

Budget Analyst View All Workers

Oracle Fusion Enterprise Planningand Budgeting

Budget Manager View All Workers

Oracle Fusion FinancialConsolidation Hub

Consolidation Accountant View All Workers

Oracle Fusion FinancialConsolidation Hub

Consolidation Manager View All Workers

Oracle Fusion Financials CommonModule

Intercompany Accountant View All Workers

Oracle Fusion General Ledger Financial Analyst View All Workers

Oracle Fusion General Ledger General Accountant View All Workers

Oracle Fusion General Ledger General Accounting Manager View All Workers

Oracle Fusion IncentiveCompensation

Incentive CompensationParticipant Manager

View Manager Hierarchy

Oracle Fusion InventoryManagement

Warehouse Manager View All Workers

Oracle Fusion Project Foundation Project Accountant View All Workers

Oracle Fusion Project Foundation Project Administrator View All Workers

Oracle Fusion Project Foundation Project Billing Specialist View All Workers

Oracle Fusion Purchasing Buyer View All Workers

Oracle Fusion Sourcing Category Manager View All Workers

Oracle Fusion Sourcing Sourcing Project Collaborator View All Workers

For example, as part of their Transactional Business Intelligence setup:

• Oracle Fusion Assets implementors must assign the predefined securityprofile View All Workers to the Asset Accountant and Asset AccountingManager job roles.

• Oracle Fusion Incentive Compensation implementors must assign thepredefined security profile View Manager Hierarchy to the abstract roleIncentive Compensation Participant Manager.

The security profiles that HCM roles need to access Transactional BusinessIntelligence are assigned during the setup of HCM data security: no additionalsetup is required for Transactional Business Intelligence purposes.

Enabling an Oracle Fusion Transactional Business Intelligence User to Access

Person Data: Worked Example

This example shows how to assign a security profile to a job or abstract role toenable users with that role to access person data. This task is required for usersof Oracle Fusion Transactional Business Intelligence (Transactional BusinessIntelligence) who do not also use Oracle Fusion Human Capital Management(HCM).

Define Transactional Business Intelligence Configuration for Product Management 11-3

The following table summarizes key decisions for this scenario. Whenperforming this task, use the job or abstract role for your product and the nameof the relevant predefined person security profile in place of those shown here.


What is the name of the Transactional BusinessIntelligence job or abstract role?

Warehouse Manager

What is the name of the person security profile? View All Workers

Summary of the Tasks

To perform these tasks, you must have the role IT Security Manager.

1. Launch the task Manage Data Role and Security Profiles.

2. Search for the job or abstract role.

3. Assign the relevant predefined security profile to the job or abstract role.

Launching the Task Manage Data Role and Security Profiles

1. On the Overview page of the Setup and Maintenance work area, click theAll Tasks tab.

2. In the Search region, complete the fields as shown in this table:

Field Value

Search Tasks

Name Manage Data Role and Security

Profiles

3. Click Search.

4. In the search results, click Go to Task for the Manage Data Role andSecurity Profiles task.

Searching for the Job or Abstract Role

1. On the Manage HCM Data Roles page, enter the job name WarehouseManager in the Role field.

2. Click Search.

3. In the search results, highlight the entry for the Warehouse Manager jobrole.

4. Click Assign.

Assigning the Security Profile to the Job Role

1. In the Person Security Profile field on the Assign Data Role: SecurityCriteria page, select the security profile View All Workers.

2. Click Review.

3. On the Assign Data Role: Review page, click Submit.

Other Common Setup and Maintenance Tasks 12-1

12Other Common Setup and Maintenance

Tasks

Customization and Sandboxes

Customizing Innovation Management: Explained

Customize view objects for Innovation Management in Oracle Fusion ProductManagement using Data Composer and Page Composer.

Custom Attributes

You can create custom attributes using Data Composer in InnovationManagement.

Use Data Composer to:

• Customize the label and help text of standard fields

• Create new top-level custom objects as well as new child objects

• Add custom fields of different types (such as text, number, date, choicelist, and checkbox) to standard and custom objects

• Define application behavior using groovy validation rules, triggers, andfunctions

Custom attributes are implicitly tied to Value Objects (VO), each belonging toits own business object. The custom attributes that you create are added to aresource catalog, and are visible on search using Page Composer.

A value object in Innovation Management refers to business objects (forexample: concepts, ideas, requirements), line-level objects (for example: conceptcomponents), or relationship objects (for example: concept structures).

The following table summarizes the customizable objects, pages, and regions inInnovation Management applications. The view objects listed here are availableon the Data Composer user interface for customizations.


View Object Corresponding Page or Region

Idea Edit Idea, Manage Ideas, Search

Create Idea dialog

Requirements Details tab, Create Requirement Line dialog

Table view

Search

RequirementSpecification Create Req Spec dialog

Search

Details tab

Feature Create Feature Set dialog, Feature Set detail page

Search

FeatureLine Create Feature dialog, Feature detail page

FeatureLineProposal Feature Proposal table

Concept Create Concept dialog

Specifications Pane

Search (Manage Concepts)

Search (structure table)

Component Specification Pane

Search

ConceptStructure Table

Specification Pane

Manage Custom Objects

To customize objects, access Product Innovation Custom Objects using theCustom Objects link from the Navigator. As an Application ImplementationConsultant, you can then expose the customizations to the corresponding userinterface region or pages using the Page Composer.

You can also edit the business logic associated with each custom object.

Customizing Simplified Pages Using Page Composer: Points to Consider

On a simplified page , you can click your name and select Customize UserInterface to customize the UI using Page Composer. When customizing asimplified page, consider the customization layer to choose, the types ofcustomizations you can make, and labels for your saved changes.

Customization Layers

The customization layer that you select before making changes to the pagedetermines the scope of users impacted by your customizations. If you are


not presented with customization layers to choose from after you selectCustomize User Interface, then your changes are made to the site layer. Formore information to understand customization layers, see the Oracle FusionApplications Extensibility Guide for Business Analysts.

Types of Customizations

In simplified pages, customization using Page Composer is limited to what youcan change with component properties. For example, you can show or hidefields or make a check box required, but you cannot add new components orchange the layout of the page.

After you select a customization layer, if available, you can click:

• Design to navigate around and get to the components you want tocustomize. You cannot make any customizations in this mode.

• Select to select a component on the page and open its properties.

Each component has its own set of properties, which may include some of theproperties in this table.

Property Description

Description Text used by screen readers, for information inaddition to what is provided in the Short Descproperty.

Label Display text for the component, for example the fieldprompt or the single prompt for a group of checkboxes

Read only Whether users can edit the component, for exampleif a check box can be selected or not

Rendered Whether the component is visible or hidden to userson the page

Required Whether users must enter something for thecomponent before saving the page

Short Desc Text that appears when users hover or focus on thecomponent, for example hover over a field label orclick in the text box

Show Required Whether an asterisk is displayed to indicate that thecomponent is required

When you access component properties on a workstation page using PageComposer, more properties are available.

Save and Label

Instead of just saving, optionally save and label your changes so that youcan later revert to your saved customizations. Labels are stored with aprefix of composer_. For example, if you enter myLabel, then the label iscomposer_myLabel.

As needed later, you can click your name in the global area and select ManageCustomizations. Click Promote for the desired component and select the label torevert to.


Sandboxes: Highlights

Use a sandbox to commit customizations to a runtime use session for validationbefore deploying changes to the mainline. Administrators create and managesandboxes. An active sandbox isolates changes from the mainline and otherusers.

Sandboxes can contain the following types of customization changes.

• Metadata, such as non-flexfield UI page customizations

• Data security

• Generated flexfields business components

Metadata changes are captured in a metadata sandbox. Data security changes areadditionally captured in a data security enabled sandbox. Changes to a flexfieldare captured in a flexfield that is deployed as a single flexfield sandbox. Onceyou are ready to make sandbox changes available in the mainline, you eitherpublish the metadata or data security sandbox, or deploy the flexfield. Onlymetadata and data security sandboxes can be downloaded as a sandbox file forimport to another Oracle Fusion Applications instance.

The following table lists the differences among the types of sandboxes.

Type of Changes Type of Sandbox Method for MakingChanges Available inMainline

Downloadable?

Metadata Sandbox Publish sandbox Yes

Data security Sandbox enabled for datasecurity changes

Publish sandbox Yes

Flexfield Flexfield deployedas a flexfield-enabledsandbox

Deploy flexfield No

Only one sandbox can be active at a time. Changes made while a sandbox isactive are captured in that sandbox.

For more information on using the Sandbox Manager, and customizing andsecuring pages, business objects, data, and custom objects in a sandbox, see theOracle Fusion Applications Extensibility Guide.

Managing a Page Customization Sandbox

You can make metadata (MDS) type changes in a sandbox, includingmenu customizations, changes to the personalization menu, implicit ADFcustomizations, or changes made with Oracle Composer or CRM ApplicationComposer.

• If you are entitled to do so, manage sandboxes in the Sandbox Manager.


See: Using the Sandbox Manager

• Implement customizations on an existing page to change the metadataof a sandbox before deploying the changes to the mainline.

See: Customizing Existing Pages

• Using CRM Application Composer, customize business objects in asandbox before deploying the changes to the mainline.

See: Customizing Objects

Managing a Data Security Sandbox

You can create a sandbox for data security testing, or designate an existingsandbox to become enabled for data security testing.

• If you are entitled to do so, manage data security-enabled sandboxes inthe Sandbox Manager.


• If you customize business objects in CRM Application Composer, youmay need to define data security policies to make them accessible tousers.

See: Defining Security Policies for Business Objects

• If you create new business objects, you need to secure them.

See: Customizing Security for Custom Business Objects

Managing a Flexfield Sandbox

You create a flexfield-enabled sandbox by deploying one flexfield to a sandboxusing the Manage Flexfield task flow. The flexfield sandbox gets its name fromthe flexfield you deploy. You cannot test two flexfields in the same sandbox.Once you deploy a flexfield as a sandbox, you must sign out and back in to viewhow the sandbox runtime reflects the flexfield changes, such as new segments.You can redeploy the same flexfield to the same sandbox repeatedly as you makeincremental changes to the flexfield setup.

• Since a flexfield sandbox cannot be published, any page customizations ordata security in the flexfield sandbox cannot reach the mainline when theflexfield is deployed to the mainline. If you have entitlement to do so, seeDeploying a Flexfield to a Sandbox: Points to Consider.

• If you are entitled to do so, manage flexfield-enabled sandboxes in theSandbox Manager.


Importing and Exporting Setup Data 13-1

13Importing and Exporting Setup Data

Configuration Packages: Explained

Almost all Oracle Fusion application implementations require moving functionalsetup data from one instance into another at various points in the lifecycle of theapplications. For example, one of the typical cases in any enterprise applicationimplementation is to first implement in a development or test applicationinstance and then deploy to a production application instance after thoroughtesting. You can move functional setup configurations of applications from oneapplication instance into another by exporting and importing Configurationpackages from the Manage Configuration Packages page.

A Configuration Package contains the setup import and export definition. Thesetup import and export definition is the list of setup tasks and their associatedbusiness objects that identifies the setup data for export as well as the dataitself. When you create a configuration package only the setup export andimport definition exists. Once you export the configuration package appropriatesetup data is added to the configuration package using the definition. Once aconfiguration package is exported, the setup export and import definition islocked and cannot be changed.

You generate the setup export and import definition by selecting animplementation project and creating a configuration package. The tasks and theirassociated business objects in the selected implementation project define thesetup export and import definition for the configuration package. In addition,the sequence of the tasks in the implementation project determine the export andimport sequence.

Exporting and Importing Setup Data: Explained

A configuration package is required to export setup data. You can export aconfiguration package once you create it, or at any time in the future. Duringexport, appropriate setup data will be identified based on the setup exportdefinition and added to the configuration package. The setup data in theconfiguration package is a snapshot of the data in the source applicationinstance at the time of export. After the export completes, you can download theconfiguration package as a zipped archive of multiple XML files, move it to thetarget application instance, and upload and import it.


Export

You can export a configuration package multiple times by creating multipleversions. While the export definition remains the same in each version, the setupdata can be different if you modified the data in the time period between thedifferent runs of the export process. Since each version of the configurationpackage has a snapshot of the data in the source instance, you can compare andanalyze various versions of the configuration package to see how the setup datachanged.

Import

In the target application instance, the setup import process will insert all newdata from the source configuration package that does not already exist andupdate any existing data with changes from the source. Setup data that exists inthe target instance but not in source will remain unchanged.

Export and Import Reports

You can review the results of the export and import processes using reports. Theresults appear ordered by business objects and include information on any errorsencountered during the export or import process. If a setup export or importprocess paused due to errors encountered or for a manual task to be performedoutside of the application, then you can resume the paused process.

These reports show what setup data was exported or imported and by whichspecific process. You can change the reports to validate the setup data as well asto compare or analyze it. A report is generated for each business object. Thesereports show the same information as the export and import results seen directlyin the application.

Process status details are available as text files showing the status of an export orimport process including the errors encountered during the process.

Moving Common Reference Objects

Moving Common Reference Objects: Overview

The common reference objects in Oracle Middleware Extensions for Applicationsare used by several setup tasks in the Setup and Maintenance work area. Thecommon reference objects become a part of the configuration package that iscreated for an implementation project. While moving the application content, forexample, from the test phase to the production phase of an implementation, youmust pay special attention to the nuances of these common reference objects.

Parameters

The common reference objects are represented as business objects. A singleobject can be referenced in multiple setup tasks with different parameters. In theconfiguration package that is created for the implementation project, parameterspassed to a setup task are also passed to the business objects being moved. As aresult, the scope of the setup tasks is maintained intact during the movement.


Dependencies

Common reference objects may have internal references or dependenciesamong other common reference objects. Therefore, it is necessary that all thedependencies are noted before the movement of objects so that there are nobroken references among the objects.

Business Objects for Moving Common Reference Objects: Points to Consider

Common reference objects in Oracle Fusion Functional Setup Manager arerepresented by business objects. These business objects are the agents thatcontain the application content and carry them across whenever the applicationsetup is moved from one environment to another, for example, test environmentto production environment.

Choice of Parameters

The following table lists the business objects, the corresponding movementdetails, and the effect of the setup task parameter on the scope of the movement.

Note

• Only the translation in the current user language is moved.

• The Oracle Social Network business objects and the Navigatormenu customizations are moved using the customization sets on theCustomization Migration page instead of using the export and importfunction in the Setup and Maintenance work area.

Business Object Name Moved Functional Item Effect on the Scope of Movement

Application Message Messages and associated tokens No parameters: all messages aremoved.

moduleType/moduleKey:only messages belonging tothe specified module and itsdescendant modules in thetaxonomy hierarchy are moved.

messageName/applicationId:only the specified message ismoved.

Application Taxonomy Application taxonomy modulesand components

No parameters: all taxonomymodules and components aremoved.

Application Attachment Entity Attachment entities No parameters: all attachmententities are moved.

moduleType/moduleKey: onlyattachment entities belongingto the specified module andits descendant modules in thetaxonomy hierarchy are moved.


Application Attachment Category Attachment categories andcategory-to-entity mappings

No parameters: all attachmentcategories and category-to-entitymappings are moved.

moduleType/moduleKey: onlyattachment categories belongingto the specified module andits descendant modules in thetaxonomy hierarchy along withthe respective category-to-entitymappings are moved.

Application Document SequenceCategory

Document sequence categories No parameters: all categories aremoved.

moduleType/moduleKey:only categories belonging tothe specified module and itsdescendant modules in thetaxonomy hierarchy are moved.

code/applicationId: only thespecified document sequencecategory code is moved.

Application Document Sequence Document sequences and theirassignments

No parameters: all sequences aremoved.

moduleType/moduleKey: onlydocument sequences belongingto the specified module andits descendant modules in thetaxonomy hierarchy are moved

name: only the specified documentsequence is moved.


Application Descriptive Flexfield Descriptive flexfield registrationdata and setup data

No parameters: all descriptiveflexfields are moved.

moduleType/moduleKey: onlydescriptive flexfields belongingto the specified module andits descendant modules in thetaxonomy hierarchy are moved.

descriptiveFlexfieldCode/applicationId: only the specifieddescriptive flexfield is moved.

Note

Importing a flexfield's metadatacan change its deploymentstatus and therefore, the affectedflexfields must be redeployed.The import process automaticallysubmits affected flexfields forredeployment.

Note

Only flexfields with a deploymentstatus of Deployed or Deployed toSandbox are eligible to be moved.

Application Extensible Flexfield Extensible flexfield registrationdata and setup data, includingcategories

No parameters: all extensibleflexfields are moved

moduleType/moduleKey: onlyextensible flexfields belongingto the specified module andits descendant modules in thetaxonomy hierarchy are moved.

extensibleFlexfieldCode/applicationId: only the specifiedextensible flexfield is moved.

Note


Note



Application Key Flexfield Key flexfield registration data andsetup data

No parameters: all key flexfieldsare moved.

moduleType/moduleKey: onlykey flexfields belonging tothe specified module and itsdescendant modules in thetaxonomy hierarchy are moved.

keyFlexfieldCode/applicationId: only the specifiedkey flexfield is moved.

Note


Note


Application Flexfield Value Set Value set setup data No parameters: all value sets aremoved.

moduleType/moduleKey:only value sets belonging tothe specified module and itsdescendant modules in thetaxonomy hierarchy are moved.

valueSetCode: only the specifiedvalue set is moved.

Note

Importing a value set's metadatacan change the deployment statusof flexfields that use the valueset, and therefore the affectedflexfields must be redeployed.The import process automaticallysubmits affected flexfields forredeployment.

Application Reference Currency Currency data No parameters: all currencies aremoved.

Application Reference ISOLanguage

ISO language data No parameters: all ISO languagesare moved.

Application Reference Industry Industry data including industriesin territories data

No parameters: all industries aremoved.


Application Reference Language Language data No parameters: all languages aremoved.

Application Reference NaturalLanguage

Natural language data No parameters: all naturallanguages are moved.

Application Reference Territory Territory data No parameters: all territories aremoved.

Application Reference Time zone Time zone data No parameters: all time zones aremoved.

Application Standard Lookup Standard lookup types and theirlookup codes

No parameters: all standardlookups are moved.

moduleType/moduleKey: onlystandard lookups belongingto the specified module andits descendant modules in thetaxonomy hierarchy are moved.

lookupType: only the specifiedcommon lookup is moved.

Application Common Lookup Common lookup types and theirlookup codes

No parameters: all commonlookups are moved.

moduleType/moduleKey - onlycommon lookups belongingto the specified module andits descendant modules in thetaxonomy hierarchy are moved.

lookupType: only the specifiedcommon lookup is moved.

Application Set-Enabled Lookup Set-enabled lookup types andtheir lookup codes

No parameters: all set-enabledlookups are moved.

moduleType/moduleKey: onlyset-enabled lookups belongingto the specified module andits descendant modules in thetaxonomy hierarchy are moved.

lookupType: only the specifiedset-enabled lookup is moved.

Application Profile Category Profile categories No parameters: all profilecategories are moved.

moduleType/moduleKey:only categories belonging tothe specified module and itsdescendant modules in thetaxonomy hierarchy are moved.

name/applicationId: only thespecified category is moved.


Application Profile Option Profile options and their values No parameters: all profile optionsand their values are moved.

moduleType/moduleKey: onlyprofile options and their valuesbelonging to the specified moduleare moved.

profileOptionName: only thespecified profile option and itsvalues are moved.

Application Profile Value Profile options and their values No parameters: all profiles andtheir values are moved.

moduleType/moduleKey: onlyprofiles and their values belongingto the specified module aremoved.

categoryName/categoryApplicationId: onlyprofiles and their values belongingto the specified category aremoved.

profileOptionName: only thespecified profile and its values aremoved.

Application Reference Data Set Reference data sets No parameters: all sets are moved.

Application Reference Data SetAssignment

Reference data set assignments determinantType: onlyassignments for the specifieddeterminant type are moved.

determinantType/referenceGroupName: onlyassignments for the specifieddeterminant type and referencegroup are moved.

Application Tree Structure Tree structures and any labelsassigned to the tree structure

No parameters: all tree structures(and their labels) are moved.

moduleType/moduleKey: onlytree structures (and their labels)belonging to the specified moduleare moved.

treeStructureCode: only thespecified tree structure (with itslabels) is moved.


Application Tree Tree codes and versions No parameters: all trees aremoved.

moduleType/moduleKey: onlytrees belonging to the specifiedmodule are moved.

treeStructureCode: only treesbelonging to the specified treestructure are moved.

TreeStructureCode/TreeCode:only trees belonging to thespecified tree structure and treecode are moved.

Application Tree Label Tree structures and any labelsassigned to the tree structure

No parameters: all tree structures(and their labels) are moved.

moduleType/moduleKey: onlytree structures (and their labels)belonging to the specified moduleand its descendant modules in thetaxonomy hierarchy are moved.

treeStructureCode: only thespecified tree structure (with itslabels) is moved.

Application Data Security Policy Database resources, actions,conditions, and data securitypolicies

No parameters: all databaseresources/actions/conditions/policies are moved.

moduleType/moduleKey: onlydatabase resources/actions/conditions/policies belongingto the specified module andits descendant modules in thetaxonomy hierarchy are moved.

objName: only the specifieddatabase resource along with itsactions/conditions/policies ismoved.

Note

• If the policies being movedcontain reference to newlycreated roles, move the rolesbefore moving the policies.

• If the source and targetsystems use differentLDAPs, manually performthe GUID reconciliationafter moving the datasecurity policies.

Application Activity StreamConfiguration

Activity stream options No parameters: all activity streamoptions are moved.


Moving Related Common Reference Objects: Points to Consider

Certain common reference objects may use other common reference objectscreating dependencies among the objects. During the movement of commonreference objects, these dependencies or references need to be taken care of.

Dependencies

The dependencies among the common reference objects may be caused by any ofthe following conditions.

• Flexfield segments use value sets

• Value sets may make use of standard, common, or set-enabled lookups

• Key flexfields may have an associated tree structure and key flexfieldsegments may have an associated tree code

• Tree codes and versions may be defined over values of a value set

• Data security policies may be defined for value sets that have beenenabled for data security

You may choose to move one, some, or all of the business objects by includingthe ones you want to move in your configuration package. For example, youmay choose to move only value sets and not lookups, or you may choose tomove both value sets and their lookups as part of the same package. Whateverbe the combination, it is recommended that during the movement of objects, youfollow an order that maintains the dependencies among the objects.

While moving the business objects, adhere to the guidelines and exactly followthe order as listed below.

1. Move created taxonomy modules before moving any objects that referencethem, such as flexfields, lookups, profiles, attachments, reference datasets, document sequences, messages, and data security.

2. Move created currencies before moving any objects that reference them,such as territories.

3. Move created territories before moving any objects that reference them,such as languages and natural languages.

4. Move created ISO languages before moving any objects that referencethem, such as languages, natural languages, and industries.

5. Move created tree structures before moving any objects that referencethem, such as trees or tree labels.

6. Move created profile options before moving any objects that referencethem, such as profile categories or profile values.

7. Move created attachment entities before moving any objects that referencethem, such as attachment categories that reference them.

Note


In scenarios where there may be dependencies on other objects, you must movethe dependencies before moving the referencing object. For example, if datasecurity policies being moved have dependencies on newly created securityroles, you must move the security roles before moving the security policies.

Using Seed Data Framework to Move Common Reference Objects: Points to

Consider

To move the common reference objects, you can use the Seed Data Framework(SDF). You can also use the command line interface of SDF to move the objectsetup data. For more information about seed data loaders including commonreference object loaders, see Oracle Fusion Applications Developer's Guide.

Movement Dependencies

The seed data interface moves only the setup metadata. For example, if you useSDF to import flexfield metadata, the flexfield setup metadata is imported intoyour database. However, you must invoke the flexfield deployment processseparately after seed data import to regenerate the runtime flexfield artifactsin the target environment. Similarly, if you use SDF to import data securitymetadata, you must first move any new referenced roles and then manually runthe GUID reconciliation where required.

To ensure that the reference data is not lost during the movement, certainguidelines are prescribed. It is recommended that you perform the movement ofobject data exactly in the order given below.

Note

Only the translation in the current user language is moved.

1. Move created taxonomy modules before moving any objects that referencethem, such as flexfields, lookups, profiles, attachments, reference datasets, document sequences, messages, and data security.

2. Move created currencies before moving any objects that reference them,such as territories.

3. Move created territories before moving any objects that reference them,such as languages and natural languages.

4. Move created ISO languages before moving any objects that referencethem, such as languages, natural languages, and industries.

5. Move created tree structures before moving any objects that referencethem, such as trees or tree labels.

6. Move created profile options before moving any objects that referencethem, such as profile categories or profile values.

7. Move created attachment entities before moving any objects that referencethem, such as attachment categories that reference them.

8. Move created reference data sets before moving any objects that referencethem, such as reference data set assignments and set-enabled lookups.


9. Move created document sequence categories before moving any objectsthat reference them, such as document sequences.

10. Move created tree labels before moving any objects that reference them,such as trees.

11. Move created data security objects and policies before moving any objectsthat reference them, such as value sets.

12. Move created value sets before moving any objects that reference them,such as flexfields.

13. Move created trees before moving any objects that reference them, such askey flexfields.

Define Product Innovation 14-1

14Define Product Innovation

Class Management in Product Innovation: Explained

Class Management is the definition of classes, class hierarchies, and class codesto establish reusable business objects. This topic introduces Class Managementfor Ideas, Requirements Specifications, Concepts, and Portfolios in InnovationManagement.

The tasks addressed in this topic are:

• Manage Product Idea Classes

• Manage Product Requirement Classes

• Manage Product Concept Classes

• Manage Product Concept Component Classes

• Manage Product Portfolio Classes

Class

Use classes and subordinate classes to define business object types.

When you create a class, the class name that you provide is stored and used asan object type, at the time of business object creation.

Select a class to edit the class name and description. The Object CreationAllowed Indicator in the Edit Class page controls the possibility of creatingbusiness objects of the current class value. Select the indicator to ensure that theclass name is available to use as a type when creating a business object.

Class Code

A Class Code is a constant and unique value associated with each class acrossFusion Innovation Management and associated Product Lifecycle Management(PLM) systems.

You can define a class code only once, when creating a class, as it is used duringintegration with external systems, and is required to remain a consistent internalcode.


Note

You cannot edit the class code after class creation. However, you can delete theexisting class, if it was not already used to create an object, and create a new classwith the required class code.

Class Hierarchy

Class Hierarchy allows you to group and search for classes, based on class valuesor business objects types.

Select a class in the Manage Class page to view the class hierarchy in the EditClass page.

Managing Lookups in Innovation Management: Explained

Oracle Fusion Innovation Management provides lookups that you can useto define values in Requirements, Concept, and Portfolio modules duringimplementation.

This topic addresses the following tasks:

• Manage Product Requirements and Ideation Lookups

• Manage Product Concept Lookups

• Manage Product Portfolio Lookups

Use standard lookups in Innovation Management to define values such as type,status, priority, scope, compliance, resource pool, metrics, lifecycle phases, andrank.

Application statuses in Innovation Management are also standard lookups. Youcan execute the following tasks as lookup tasks:

• Manage Product Idea Statuses

• Manage Product Requirement Statuses

• Manage Product Concept Statuses

• Manage Proposal Statuses

• Manage Portfolio Statuses

Define Product Lifecycle Portfolio Management

Manage Planning Periods: Explained

Product portfolio planning period is the time period during which the portfolioobjects collect data for analysis. Before defining a planning period, you are

Define Product Innovation 14-3

required to create planning period units. You provide start date, number of unitsand specify the duration, which can be either monthly or quarterly to createplanning period time units. The planning period time units are created withdefault labels. You can add time units for a previously created planning periodunit by providing the number of units before the first unit or by providing thenumber of units after the last unit.

Note

After you have created a planning period unit specifying a duration, you cannotmake further changes except for changing the names of the units.

To create a planning period, provide the start date planning period unit, end dateplanning period unit, and select the planning period unit from the choice list.

Impact of planning period and planning period units:

• The columns in the Manage Resource Capacity table is dynamicallycreated and displayed based on the number of planning period unitsdefined in the planning period for the portfolio.

• The time line in the Schedule Gantt, Resource Gantt and Launch Ganttis decided based on the number of planning period units defined in theplanning period for the portfolio.

Registering Agile PLM: Explained

This task is a prerequisite for the Manage Target System task, if you need toconnect Oracle Agile Product Lifecycle Management to Fusion InnovationManagement.

Managing Target System: Explained

The Manage Target System page is where you configure connections betweenFusion Innovation Management and Product Lifecycle Management (PLM)systems, supported on the Applications Unlimited framework.

The Applications Unlimited framework uses webservices to create and retrievedata through the Fusion Innovation Management and PLM system connections.

• Use the Manage Connections page to define entities and their attributesthat enable access between Fusion Innovation Management and PLMsystems

• Use the Manage Mapping to External System page to map FusionInnovation Management to PLM systems

• Use the Manage Mapping to Innovation Management page to mapFusion Innovation Management entities and attributes to multipleApplications Unlimited entities, depending on the mapping set used


Manage Connections Page

The Manage Connections page allows the administrator to:

• Configure multiple PLM system connections, and activate any one at agiven time

• Duplicate the existing connector templates to create a new connection

• Edit configuration of a new connection by selecting it and clicking theEdit icon or using the Actions menu

• Define the engineering change order processing type to use whentransferring items or item structures to PLM

Note

You cannot edit the attributes of a connector template.

Manage Mapping to External System Page

Use the Manage Mapping to External System page to:

• Define entities, subordinate entities, and their relationships tocorresponding entities in the PLM system.

Note

The data you define here decides the data available for all future integration usecases.

• Define the individual attributes of entities. Decide the order of visibilityof each attribute, and if it is searchable in the connected, external PLMsystem.

Manage Mapping to Innovation Management Page

Use the Manage Mapping to Innovation Management page to:

• Select a connection and a mapping set to view, add, and edit theassociated entities.

Note

You cannot edit entities of a connector template.

• View, add, and edit attributes of the selected entity.

• Specify value transformations to convert data from the data formats ofPLM systems into the data formats of Fusion Innovation Management, orconversely.

• Use the From and To Converter options for handling custom conversionsbetween data types in Fusion Innovation Management and a PLM system.

Glossary-1

Glossaryabstract role

A description of a person's function in the enterprise that is unrelated to theperson's job (position), such as employee, contingent worker, or line manager. Atype of enterprise role.

action

The kind of access named in a security policy, such as view or edit.

activity stream

A feature that tracks and displays actions and messages from people whom youare connected to in your social network, as well as activities from the application.

ADF

Acronym for Application Developer Framework. A set of programmingprinciples and rules for developing software applications.

application identity

Predefined application level user with elevated privileges. An applicationidentity authorizes jobs and transactions for which other users are notauthorized, such as a payroll run authorized to access a taxpayer ID while theuser who initiated the job is not authorized to access such personally identifiableinformation.

application role

A role specific to applications and stored in the policy store.

Applications Core

Abbreviation for Oracle Middleware Extensions for Applications. The technicalproduct code is FND.

assignment

A set of information, including job, position, pay, compensation, managers,working hours, and work location, that defines a worker's or nonworker's role ina legal employer.

beneficiary

A person or organization designated to receive benefits from a compensationplan on the death of the plan participant.

BPEL

Business Process Execution Language; a standard language for defining howto send XML messages to remote services, manipulate XML data structures,receive XML messages asynchronously from remote services, manage events and

Glossary-2

exceptions, define parallel sequences of execution, and undo parts of processeswhen exceptions occur.

business object

A resource in an enterprise database, such as an invoice or purchase order.

business unit

A unit of an enterprise that performs one or many business functions that can berolled up in a management hierarchy.

condition

An XML filter or SQL predicate WHERE clause in a data security policy thatspecifies what portions of a database resource are secured.

context

A grouping of flexfield segments to store related information.

context segment

The flexfield segment used to store the context value. Each context value canhave a different set of context-sensitive segments.

context-sensitive segment

A flexfield segment that may or may not appear depending upon a context suchas other information that has been captured. Context-sensitive segments arecustom attributes that apply to certain entity rows based on the value of thecontext segment.

contingent worker

A self-employed or agency-supplied worker. Contingent worker workrelationships with legal employers are typically of a specified duration. Anyperson who has a contingent worker work relationship with a legal employer is acontingent worker.

corporate rate type

Rate you define to standardize rates used in conversion of one currency toanother over a period of time. This rate is generally a standard market ratedetermined by senior financial management for use throughout the organization.

data dimension

A stripe of data accessed by a data role, such as the data controlled by a businessunit.

data instance set

The set of human capital management (HCM) data, such as one or more persons,organizations, or payrolls, identified by an HCM security profile.

Glossary-3

data role

A role for a defined set of data describing the job a user does within that definedset of data. A data role inherits job or abstract roles and grants entitlement toaccess data within a specific dimension of data based on data security policies. Atype of enterprise role.

data role template

A template used to generate data roles by specifying which base roles to combinewith which dimension values for a set of data security policies.

data security

The control of access to data. Data security controls what action a user can takenagainst which data.

data security policy

A grant of entitlement to a role on an object or attribute group for a givencondition.

database resource

An applications data object at the instance, instance set, or global level, which issecured by data security policies.

department

A division of a business enterprise dealing with a particular area of activity.

descriptive flexfield

Customizable expansion space, such as fields used to capture additionaldescriptive information or attributes about an entity, such as customer cases.Information collection and storage may be configured to vary based onconditions or context.

desktop page

A page in a user interface that is optimized for extended periods of use withmonitors.

determinant

A value that determines which reference data set will be used in a specificbusiness context.

determinant type

Designates the field within transactional columns that controls how data isshared across organizations such as business unit, asset book, cost organizationor project unit. The type determines the reference data sets that would be used ina transaction.

Glossary-4

determinant type

An additional and optional field within transactional columns (besides categoryand application) that is used to assign document sequences. The availabledeterminant types are Business Unit, Ledger, Legal Entity, and Tax Registration.

determinant value

A value specific to the determinant type dimension of a document sequence. Thedeterminant value is relevant in a document sequence assignment only if thedocument sequence has a determinant type. If Ledger is the determinant type fora document sequence, the determinant value is the specific ledger number whosedocuments are numbered by the document sequence.

document sequence

A unique number that is automatically or manually assigned to a created andsaved document.

document type

A categorization of person documents that provides a set of options to controlwhat document information to retain, who can access the documents, whetherthe documents require approval, and whether the documents are subject toexpiry. A document type exists for a combination of document category andsubcategory.

duty role

A group of function and data privileges representing one duty of a job. Dutyroles are specific to applications, stored in the policy store, and shared within anOracle Fusion Applications instance.

enterprise

An organization with one or more legal entities under common control.

enterprise role

Abstract, job, and data roles are shared across the enterprise. An enterprise roleis an LDAP group. An enterprise role is propagated and synchronized acrossOracle Fusion Middleware, where it is considered to be an external role or rolenot specifically defined within applications.

entitlement

Grants of access to functions and data. Oracle Fusion Middleware term forprivilege.

extensible flexfield

Customizable expansion space, as with descriptive flexfields, but able to capturemultiple sets of information within a context and multiple contexts grouped toappear in a named region of a user interface page. Some extensible flexfieldsallow grouping contexts into categories.

Glossary-5

feature choice

A selection you make when configuring offerings that modifies a setup task list,or a setup page, or both.

fixed rate type

Rate you set between two currencies that remains constant. For example, a rateset between the euro currency and each Economic and Monetary Union (EMU)currency during the conversion to the euro currency.

flexfield

Grouping of extensible data fields called segments, where each segment is anattribute added to an entity for capturing additional information.

flexfield segment

An extensible data field that represents an attribute on an entity and captures asingle atomic value corresponding to a predefined, single extension column inthe Oracle Fusion Applications database. A segment appears globally or basedon a context of other captured information.

function security

The control of access to a page or a specific widget or functionality within a page.Function security controls what a user can do.

gallery

A searchable collection of portraits that combines the functions of the persondirectory with corporate social networking and self-service applications for bothworkers and managers.

global area

The region across the top of the user interface. It provides access to features andtools that are relevant to any page you are on.

HCM

Abbreviation for Human Capital Management.

HCM data role

A job role, such as benefits administrator, associated with specified instances ofOracle Fusion Human Capital Management (HCM) data, such as one or morepositions or all persons in a department.

HCM securing object

An HCM object that secures access to both its own data and data in other, relatedobjects. For example, access to a specified set of person records can allow accessto data secured by person records, such as goal plans and evaluations.

Glossary-6

identity

A person representing a worker, supplier, or customer.

job

A generic role that is independent of any single department or location. Forexample, the jobs Manager and Consultant can occur in many departments.

job role

A role for a specific job consisting of duties, such as an accounts payablemanager or application implementation consultant. A type of enterprise role.

key flexfield

Configurable key consisting of multiple parts or segments, each of which maybe meaningful individually or in combination with the others. Key flexfields arecommonly implemented to represent part numbers and account numbers.

key flexfield structure

The arrangement of segments in a key flexfield. In some cases, multiplestructures can be defined for a single key flexfield.

legal employer

A legal entity that employs people.

legislative data group

A means of partitioning payroll and related data. At least one legislative datagroup is required for each country where the enterprise operates. Each legislativedata group is associated with one or more payroll statutory units.

lookup code

A value available for lookup within a lookup type such as the code BLUE withinthe lookup type COLORS.

lookup type

A set of lookup codes to be used together as a list of values on a field in the userinterface.

mainline

A branch of data that serves as a single source of truth.

managed person

In Oracle Fusion Human Capital Management security, a person for whom theuser can maintain some information. For example, line managers can maintain

Glossary-7

information about their direct and indirect reports, and workers can maintaininformation about themselves, their dependents, and their beneficiaries.

offering

A comprehensive grouping of business functions, such as Sales or ProductManagement, that is delivered as a unit to support one or more businessprocesses.

OWLCS

Abbreviation for Oracle WebLogic Communication Services. Offers the TPCCservice to Fusion applications and sets up the calls via SIP integration with thetelephony network.

party

A physical entity, such as a person, organization or group, that the deployingcompany has an interest in tracking.

pending worker

A person who will be hired or start a contingent worker placement and forwhom you create a person record that is effective before the hire or start date.

person number

A person ID that is unique in the enterprise, allocated automatically or manually,and valid throughout the enterprise for all of a person's work and person-to-person relationships.

person type

A subcategory of a system person type, which the enterprise can define. Persontype is specified for a person at the employment-terms or assignment level.

personally identifiable information

Any piece of information that can potentially be used to uniquely identify,contact, or locate a single person. Within the context of an enterprise, some PIIdata can be considered public, such as a person's name and work phone number,while other PII data is confidential, such as national identifier or passportnumber.

PL/SQL

Abbreviation for procedural structured queried language.

portrait

A selection of information about a worker or nonworker, including contactdetails, social connections, and activities and interests, that can be viewed andedited. Both the amount and type of information and the available actionsdepend on the role of the portrait user.

Glossary-8

position

A specific occurrence of one job, fixed within one department, also often onelocation. For example, the position Finance Manager is an instance of the jobManager in the Finance Department.

privilege

A grant or entitlement of access to functions and data. A privilege is a single, realworld action on a single business object.

profile option

User preferences and system configuration options consisting of a name and avalue, that can be set at hierarchical levels of an enterprise. Also called a profileor user option.

profile option level

A level at which profile option values are defined. Site, product, and user arepredefined levels.

profile option level hierarchy

The ordering of profile option levels. The order of the levels in the hierarchydetermines which levels take precedence.

profile option value

The value portion of a profile option's name and value. A profile option mayhave multiple values set at different levels, such as site or user.

PSTN

Abbreviation for public switched telephone network which is the network of theworld's public circuit-switched telephone networks.

public person

In Oracle Fusion Human Capital Management security, a person for whom somebasic information is publicly available. For example, users typically access thecontact details of public persons, such as phone numbers and locations, using theperson gallery.

reference data

Data in application tables that is not transactional and not high-volume such assales methods, transaction types, or payment terms, and can be shared and usedacross organizational boundaries.

reference data set

Contains reference data that can be shared across a number of business unitsor other determinant types. A set supports common administration of thatreference data.

Glossary-9

reference group

A logical grouping of tables that correspond to logical entities such as paymentterms defined across multiple tables or views. Grouping establishes commonpartitioning requirements across the entities causing them to share the same setassignments.

resource

People designated as able to be assigned to work objects, for example, serviceagents, sales managers, or partner contacts. A sales manager and partnercontact can be assigned to work on a lead or opportunity. A service agent can beassigned to a service request.

role

Controls access to application functions and data.

role hierarchy

Structure of roles to reflect an organization's lines of authority and responsibility.In a role hierarchy, a parent role inherits all the entitlement of one or more childroles.

role mapping

A relationship between one or more job roles, abstract roles, and data rolesand one or more conditions. Depending on role-mapping options, the role canbe provisioned to or by users with at least one assignment that matches theconditions in the role mapping.

role provisioning

The automatic or manual allocation of an abstract role, a job role, or a data role toa user.

sandbox

A runtime session that commits changes out of reach of mainline users.

security profile

A set of criteria that identifies one or more human capital management (HCM)objects of a single type for the purposes of securing access to those objects.Security profiles can be defined for persons, organizations, positions, countries,LDGs, document types, payrolls, payroll flows, and workforce businessprocesses.

security reference implementation

Predefined function and data security in Oracle Fusion Applications,including role based access control, and policies that protect functions, data,and segregation of duties. The reference implementation supports identity

Glossary-10

management, access provisioning, and security enforcement across the tools,data transformations, access methods, and the information life cycle of anenterprise.

segregation of duties

An internal control to prevent a single individual from performing two or morephases of a business transaction or operation that could result in fraud.

set

Reference data that is organized into groups appropriate to organizationalentities, to enable reference data sharing.

set enabled

An entity, such as a lookup, customer, location, organization, or documentattachment, that is allowed to participate in reference data sharing by drawingon the data of a reference data set.

simplified page

A page in a user interface that is optimized to provide quick access to high-volume, self-service tasks from any device.

SOA

Abbreviation for service-oriented architecture.

spot rate type

Rate you enter to perform conversion based on this rate as of a specific date. Thisrate applies to the immediate delivery of a currency.

SQL predicate

A type of condition using SQL to constrain the data secured by a data securitypolicy.

system person type

A fixed name that the application uses to identify a group of people.

territory

A legally distinct region that is used in the country field of an address.

tree

Information or data organized into a hierarchy with one or more root nodesconnected to branches of nodes. A tree must have a structure where each nodecorresponds to data from one or more data sources.

Glossary-11

tree structure

Characteristics applied to trees, such as what data to include or how the tree isversioned and accessed.

tree version

An instance of a tree. If a tree is associated with a reference data set, all versionsbelong to one set. Includes life cycle elements such as start and end date and astatus indicator whether the tree is active or not.

user rate type

Rate you enter at journal entry time to convert foreign currency transactions toyour functional currency.

value set

A set of valid values against which values entered by an end user are validated.The set may be tree structured (hierarchical).

work relationship

An association between a person and a legal employer, where the worker typedetermines whether the relationship is a nonworker, contingent worker, oremployee work relationship.

worker type

A classification selected on a person's work relationship, which can be employee,contingent worker, pending worker, or nonworker.

workflow

An automated process in which tasks are passed from a user, a group of users, orthe application to another for consideration or action. The tasks are routed in alogical sequence to achieve an end result.

workforce business process

A defined sequence of tasks, registered for the enterprise, that delivers a majorbusiness goal. The tasks may be allocated to multiple roles across multipleproducts.

XML

Abbreviation for eXtensible markup language.

XML filter

A type of condition using XML to constrain the data secured by a data securitypolicy.

oracle fusion supply chain management implementing innovation … · 2014-06-26 · overview 1-1 1...

Documents